CVE-2026-68398
Received Received - Intake

Use-After-Free in Linux Kernel PPP over L2TP

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path: l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv() -> ppp_input(&po->chan) It runs under rcu_read_lock() holding only an l2tp_session reference and takes NO reference on the internal PPP channel (struct channel, chan->ppp) that ppp_input() dereferences. The pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel are RCU-safe. But the internal struct channel is a separate allocation that ppp_release_channel() frees with a plain kfree(): close(data socket) -> pppol2tp_release() -> pppox_unbind_sock() -> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch) For a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit (no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips both ppp_disconnect_channel()'s synchronize_net() and ppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace period. rcu_read_lock() in pppol2tp_recv() does not protect against a plain kfree(), so an in-flight ppp_input() on one CPU can dereference the channel just freed by close() on another CPU. The bug is reachable by an unprivileged user. Defer the channel free to an RCU callback via call_rcu() so the grace period fences any in-flight ppp_input(). The disconnect and unbridge teardown paths already fence with synchronize_net()/synchronize_rcu(); call_rcu() does the same here without stalling the close() path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68398
EUVD
EUVD-2026-55584

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's PPP over L2TP (pppol2tp) implementation. It occurs when a PPP channel is freed without waiting for ongoing operations to complete. The issue arises because the channel can be freed via kfree() while another CPU is still processing it in ppp_input(), leading to potential memory corruption or crashes. The vulnerability is triggered by an unprivileged user.

Detection Guidance

This vulnerability is specific to the Linux kernel's PPP over L2TP implementation and may not have direct detection commands. Monitor kernel logs for pppol2tp or ppp-related errors, especially during network interface operations or socket closures. Check for crashes or warnings in kernel logs related to ppp_input or channel dereferencing.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. Systems using pppol2tp for network connections are at risk. The impact depends on whether the vulnerable code path is reachable in the specific kernel configuration.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. If immediate patching is not possible, consider disabling pppol2tp functionality if unused. Monitor for unusual network activity or crashes that may indicate exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68398. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart