CVE-2026-68121
Received Received - Intake

PPPoE Header Pointer Reload in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after dev_hard_header() pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This can happen when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head. Reload the PPPoE header through the skb's network-header offset after device header creation. pskb_expand_head() updates that offset when it relocates the head.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68121
EUVD
EUVD-2026-55502

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where the PPPoE header pointer becomes invalid after the skb head is reallocated by a device header callback. The pppoe_sendmsg function saves a pointer to the PPPoE header before calling dev_hard_header, which may reallocate the skb head. This leaves the saved pointer pointing to freed memory, allowing PPPoE to write six bytes through a stale pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's PPPoE implementation and may not have direct detection commands. Monitor kernel logs for PPPoE-related errors or crashes after network interface changes. Check for skb corruption or crashes in PPPoE-related processes.

Impact Analysis

This vulnerability could lead to memory corruption or a system crash if exploited. It may allow an attacker to execute arbitrary code or cause a denial of service by triggering the stale pointer write operation.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Avoid using team devices with GRE headers if possible until patched. Monitor system logs for PPPoE-related issues after kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68121. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart