CVE-2026-68121
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In the Linux kernel, pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(), which may reallocate the skb head and invalidate the pointer. Under certain conditions, this can lead to a write through a stale pointer into freed memory. The fix reloads the pointer after device header creation.
Risk Assessment
The vulnerability may lead to kernel memory corruption, potentially causing system crash or privilege escalation. It requires specific conditions but is serious.
Recommendation
Apply the official Linux kernel patch containing this fix as soon as possible and monitor distribution security advisories.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after dev_hard_header() pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This can happen when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head. Reload the PPPoE header through the skb's network-header offset after device header creation. pskb_expand_head() updates that offset when it relocates the head.