Loading vulnerability…
Use-after-free write in Linux kernel PPPoE pppoe_sendmsg()
CVE-2026-68121 is a use-after-free vulnerability in the Linux kernel PPPoE implementation. The pppoe_sendmsg() function saves a PPPoE header pointer before invoking dev_hard_header(), although device header callbacks may reallocate the socket buffer head and invalidate pointers into the original allocation. A triggering condition occurs when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback expands the buffer head, after which PPPoE writes six bytes through the stale pointer into freed kernel memory. The flaw can cause kernel memory corruption and potentially compromise system confidentiality, integrity, and availability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes a six-byte write into freed kernel memory. Potential consequences include kernel crashes and denial of service, corruption of kernel state, and compromise of confidentiality or integrity. CVE-specific assessments characterize exploitation as local, requiring low privileges and no user interaction. Reliable privilege escalation or arbitrary code execution is not established; these outcomes should not be treated as demonstrated capabilities.
If you can’t patch tonight, do this now.
No confirmed vulnerability-specific workaround is documented. Pending patch deployment, reduce exposure by limiting access to affected PPPoE networking paths and avoiding concurrent team-device reconfiguration involving non-Ethernet ports during PPPoE sends. These measures reduce opportunities to trigger the flaw but do not replace the kernel fix.
Patch, then assume compromise.
Install the distribution's released kernel security update containing the fix for CVE-2026-68121 and reboot into the corrected kernel, or apply and verify a released live patch compatible with the running kernel. The upstream correction reloads the PPPoE header pointer through the socket buffer's network-header offset after dev_hard_header() completes. This offset is maintained by pskb_expand_head() when the buffer head is relocated. Select updates appropriate to the installed distribution, support stream, architecture, and kernel flavor; updates still in QA or live patches marked in progress are not released fixes.
1 exploit validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
109 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.