{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-68398", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.389Z", "datePublished": "2026-08-10T12:04:17.771Z", "dateUpdated": "2026-08-19T16:34:49.839Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:34:49.839Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF\n\npppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:\n\n l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv()\n -> ppp_input(&po->chan)\n\nIt runs under rcu_read_lock() holding only an l2tp_session reference and\ntakes NO reference on the internal PPP channel (struct channel,\nchan->ppp) that ppp_input() dereferences.\n\nThe pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel\nare RCU-safe. But the internal struct channel is a separate allocation\nthat ppp_release_channel() frees with a plain kfree():\n\n close(data socket) -> pppol2tp_release() -> pppox_unbind_sock()\n -> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch)\n\nFor a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit\n(no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips\nboth ppp_disconnect_channel()'s synchronize_net() and\nppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace\nperiod. rcu_read_lock() in pppol2tp_recv() does not protect against a\nplain kfree(), so an in-flight ppp_input() on one CPU can dereference\nthe channel just freed by close() on another CPU.\n\nThe bug is reachable by an unprivileged user.\n\nDefer the channel free to an RCU callback via call_rcu() so the grace\nperiod fences any in-flight ppp_input(). The disconnect and unbridge\nteardown paths already fence with synchronize_net()/synchronize_rcu();\ncall_rcu() does the same here without stalling the close() path." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The free side of the race is a local close() of the pppol2tp socket, which no remote peer can invoke; the full attack (create tunnel/session via AF_PPPOX socket, drive RX with loopback UDP datagrams, close concurrently) is performed entirely through local syscalls.\nAC:L - The attacker controls both sides of the race, feeding the UDP-encap RX softirq from one thread while closing the pppox socket on another, and can retry the loop indefinitely until the window is hit.\nPR:L - No capability check exists on this path: pppox_create()/pppol2tp_connect() and ppp_register_net_channel() need no CAP_NET_ADMIN, and PPPIOCGCHAN is handled by pppox_ioctl() on the socket itself, so /dev/ppp access is not required; the fix commit states the bug is reachable by an unprivileged user.\nUI:N - The attacker performs every step — socket creation, session setup, packet injection and close() — with no action by any other user or administrator.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After the channel is freed and its slab object reallocated, ppp_input() reads pch->bridge and pch->ppp from attacker-groomed memory and can route received frames to an arbitrary attacker-chosen structure, giving a path to disclosing kernel memory.\nI:H - skb_queue_tail(&pch->file.rq, skb) writes a linked-list insertion into the freed object and wake_up_interruptible(&pch->file.rwait) traverses a freed waitqueue, so heap grooming yields controlled writes and function-pointer traversal usable for privilege escalation.\nA:H - Dereferencing and writing to the kfree()d struct channel from softirq context reliably corrupts the slab and panics or oopses the kernel, and the race can be re-triggered at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ppp/ppp_generic.c" ], "versions": [ { "version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741", "lessThan": "4e47f1ac188ece11d6fdabe44166a2776cc5bd4e", "status": "affected", "versionType": "git" }, { "version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741", "lessThan": "110b765744b147c63882f5e9cb12931c5dc8d85f", "status": "affected", "versionType": "git" }, { "version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741", "lessThan": "4bb84e964ff0fe0a171c965362de72f9820dbce9", "status": "affected", "versionType": "git" }, { "version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741", "lessThan": "3ab32218d7182705dae5c86f13925f458072da2c", "status": "affected", "versionType": "git" }, { "version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741", "lessThan": "c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa", "status": "affected", "versionType": "git" }, { "version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741", "lessThan": "06213c85d8c0994f786c093b8b2a517987943ca6", "status": "affected", "versionType": "git" }, { "version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741", "lessThan": "ec4215683e47424c9c4762fd3c60f552a3119142", "status": "affected", "versionType": "git" }, { "version": "d36e5ba7bbed5d7bd26e8609ffed503c2def401b", "status": "affected", "versionType": "git" }, { "version": "9bcc0508576b2d50efd958f2ea1c5906749c2c89", "status": "affected", "versionType": "git" }, { "version": "c2984681fe15cfb803a9132aaaf1140ab20a72c1", "status": "affected", "versionType": "git" }, { "version": "5803ecd7f6ac6f747582e775caa62ac9d0489261", "status": "affected", "versionType": "git" }, { "version": "26f8819ddd10141ebe7bbce700fbab36bfa5f478", "status": "affected", "versionType": "git" }, { "version": "3.2.99", "lessThan": "3.3", "status": "affected", "versionType": "semver" }, { "version": "3.16.54", "lessThan": "3.17", "status": "affected", "versionType": "semver" }, { "version": "4.4.225", "lessThan": "4.5", "status": "affected", "versionType": "semver" }, { "version": "4.9.225", "lessThan": "4.10", "status": "affected", "versionType": "semver" }, { "version": "4.14.182", "lessThan": "4.15", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ppp/ppp_generic.c" ], "versions": [ { "version": "4.15", "status": "affected" }, { "version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.15.216" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.1.183" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.6.148" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.12.101" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.18.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "7.1.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "7.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.99" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16.54" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.225" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.225" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.182" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4e47f1ac188ece11d6fdabe44166a2776cc5bd4e" }, { "url": "https://git.kernel.org/stable/c/110b765744b147c63882f5e9cb12931c5dc8d85f" }, { "url": "https://git.kernel.org/stable/c/4bb84e964ff0fe0a171c965362de72f9820dbce9" }, { "url": "https://git.kernel.org/stable/c/3ab32218d7182705dae5c86f13925f458072da2c" }, { "url": "https://git.kernel.org/stable/c/c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa" }, { "url": "https://git.kernel.org/stable/c/06213c85d8c0994f786c093b8b2a517987943ca6" }, { "url": "https://git.kernel.org/stable/c/ec4215683e47424c9c4762fd3c60f552a3119142" } ], "title": "ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF", "x_generator": { "engine": "bippy-1.2.0" } } } }