CVE-2026-68121high

pppoe: reload header pointer after dev_hard_header()

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7.8epss 0.1%

from disclosure to weapon40 days

Published on NVDAug 10

1st PoC+40d

exploitation probability

0.1%top 96% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after dev_hard_header() pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This can happen when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head. Reload the PPPoE header through the skb's network-header offset after device header creation. pskb_expand_head() updates that offset when it relocates the head.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Linux · Linux

public PoCs found — 2

githubgithub.com/HORKimhab/CVE-2026-68121★ 0 githubgithub.com/0xBlackash/CVE-2026-68121★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://git.kernel.org/stable/c/6866abf59976d273164a6624234d96a967280223 https://git.kernel.org/stable/c/6eed5ae7887a93160803d2b81ff88e75eefd4a4c https://git.kernel.org/stable/c/7a56e7c9b08e08fd55a1bcada24cf4fe3782b722 https://git.kernel.org/stable/c/7e9fbd7f96bcde63a7c798fe16b38cedee7a1501 https://git.kernel.org/stable/c/ba3409369c5413cdf0dcbf3a928f76b48e8c3e6a https://git.kernel.org/stable/c/bed4caecd723693f750e13adbb2c42ca1249a3fd https://git.kernel.org/stable/c/e6493a4d1ee17595766165fa446d45b7e0c318d0 https://git.kernel.org/stable/c/e9c238f6fe42fb1b4dba3a578277de32cb487937