CVE-2026-68121

CVE-2026-68121 is a use-after-free in the Linux kernel's PPPoE implementation: pppoe_sendmsg() caches a pointer to the PPPoE header before calling dev_hard_header(), but device header callbacks are allowed to reallocate the socket buffer head, leaving that pointer dangling. The race is triggered when a send blocks in copy_from_user() while the first non-Ethernet port is added to an empty team device, causing the team's delegated GRE header callback to expand the skb head; PPPoE then writes six bytes through the stale pointer into freed memory. A local attacker can leverage this memory corruption for privilege escalation, reportedly reaching a root shell as one of four recently disclosed Linux kernel LPE flaws dubbed 'PPPoEject'. Any Linux system with PPPoE support enabled is potentially affected, though practical exploitation requires local code execution plus the uncommon combination of a PPPoE socket and a team device. A public proof-of-concept has been published on GitHub, but the flaw is not in CISA's KEV catalog and EPSS remains low at 0.1%.

What to do: Update to the latest stable or vendor-supplied kernel that includes the upstream fix ('pppoe: reload header pointer after dev_hard_header()') as soon as your distribution backports it. Until patched, restrict local untrusted code execution on PPPoE-connected hosts and avoid combining PPPoE interfaces with team bonding devices or adding non-Ethernet ports to team devices on such hosts. Verify with your kernel vendor whether your running kernel contains the corrected pppoe_sendmsg() and watch distribution security advisories for the backport.