CVE-2026-68121: pppoe: reload header pointer after dev_hard_header()
In the Linux kernel, the following vulnerability has been resolved:
pppoe: reload header pointer after devhardheader()
pppoesendmsg() saves a pointer to the PPPoE header before calling devhardheader(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it.
This can happen when a send is blocked in copyfromuser() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head.
Reload the PPPoE header through the skb's network-header offset after device header creation. pskbexpandhead() updates that offset when it relocates the head.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68121?
CVE-2026-68121 has a risk rating of 48.
How do I fix CVE-2026-68121?
To fix CVE-2026-68121, ensure your Linux kernel is updated to a version that includes the patch for this vulnerability.
What type of vulnerability is CVE-2026-68121?
CVE-2026-68121 is a memory corruption vulnerability in the Linux kernel's PPPoE implementation.
What systems are affected by CVE-2026-68121?
CVE-2026-68121 affects Linux kernels that handle PPPoE network protocols.
What is the impact of CVE-2026-68121?
The impact of CVE-2026-68121 can lead to instability and potential system crashes due to invalid memory references.