{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68398","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.389Z","datePublished":"2026-08-10T12:04:17.771Z","dateUpdated":"2026-08-19T16:34:49.839Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-19T16:34:49.839Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF\n\npppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:\n\n l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv()\n   -> ppp_input(&po->chan)\n\nIt runs under rcu_read_lock() holding only an l2tp_session reference and\ntakes NO reference on the internal PPP channel (struct channel,\nchan->ppp) that ppp_input() dereferences.\n\nThe pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel\nare RCU-safe.  But the internal struct channel is a separate allocation\nthat ppp_release_channel() frees with a plain kfree():\n\n close(data socket) -> pppol2tp_release() -> pppox_unbind_sock()\n   -> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch)\n\nFor a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit\n(no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips\nboth ppp_disconnect_channel()'s synchronize_net() and\nppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace\nperiod.  rcu_read_lock() in pppol2tp_recv() does not protect against a\nplain kfree(), so an in-flight ppp_input() on one CPU can dereference\nthe channel just freed by close() on another CPU.\n\nThe bug is reachable by an unprivileged user.\n\nDefer the channel free to an RCU callback via call_rcu() so the grace\nperiod fences any in-flight ppp_input(). The disconnect and unbridge\nteardown paths already fence with synchronize_net()/synchronize_rcu();\ncall_rcu() does the same here without stalling the close() path."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The free side of the race is a local close() of the pppol2tp socket, which no remote peer can invoke; the full attack (create tunnel/session via AF_PPPOX socket, drive RX with loopback UDP datagrams, close concurrently) is performed entirely through local syscalls.\nAC:L - The attacker controls both sides of the race, feeding the UDP-encap RX softirq from one thread while closing the pppox socket on another, and can retry the loop indefinitely until the window is hit.\nPR:L - No capability check exists on this path: pppox_create()/pppol2tp_connect() and ppp_register_net_channel() need no CAP_NET_ADMIN, and PPPIOCGCHAN is handled by pppox_ioctl() on the socket itself, so /dev/ppp access is not required; the fix commit states the bug is reachable by an unprivileged user.\nUI:N - The attacker performs every step — socket creation, session setup, packet injection and close() — with no action by any other user or administrator.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After the channel is freed and its slab object reallocated, ppp_input() reads pch->bridge and pch->ppp from attacker-groomed memory and can route received frames to an arbitrary attacker-chosen structure, giving a path to disclosing kernel memory.\nI:H - skb_queue_tail(&pch->file.rq, skb) writes a linked-list insertion into the freed object and wake_up_interruptible(&pch->file.rwait) traverses a freed waitqueue, so heap grooming yields controlled writes and function-pointer traversal usable for privilege escalation.\nA:H - Dereferencing and writing to the kfree()d struct channel from softirq context reliably corrupts the slab and panics or oopses the kernel, and the race can be re-triggered at will."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ppp/ppp_generic.c"],"versions":[{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","lessThan":"4e47f1ac188ece11d6fdabe44166a2776cc5bd4e","status":"affected","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","lessThan":"110b765744b147c63882f5e9cb12931c5dc8d85f","status":"affected","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","lessThan":"4bb84e964ff0fe0a171c965362de72f9820dbce9","status":"affected","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","lessThan":"3ab32218d7182705dae5c86f13925f458072da2c","status":"affected","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","lessThan":"c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa","status":"affected","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","lessThan":"06213c85d8c0994f786c093b8b2a517987943ca6","status":"affected","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","lessThan":"ec4215683e47424c9c4762fd3c60f552a3119142","status":"affected","versionType":"git"},{"version":"d36e5ba7bbed5d7bd26e8609ffed503c2def401b","status":"affected","versionType":"git"},{"version":"9bcc0508576b2d50efd958f2ea1c5906749c2c89","status":"affected","versionType":"git"},{"version":"c2984681fe15cfb803a9132aaaf1140ab20a72c1","status":"affected","versionType":"git"},{"version":"5803ecd7f6ac6f747582e775caa62ac9d0489261","status":"affected","versionType":"git"},{"version":"26f8819ddd10141ebe7bbce700fbab36bfa5f478","status":"affected","versionType":"git"},{"version":"3.2.99","lessThan":"3.3","status":"affected","versionType":"semver"},{"version":"3.16.54","lessThan":"3.17","status":"affected","versionType":"semver"},{"version":"4.4.225","lessThan":"4.5","status":"affected","versionType":"semver"},{"version":"4.9.225","lessThan":"4.10","status":"affected","versionType":"semver"},{"version":"4.14.182","lessThan":"4.15","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ppp/ppp_generic.c"],"versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","status":"unaffected","versionType":"semver"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.99"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.225"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.225"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.182"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/4e47f1ac188ece11d6fdabe44166a2776cc5bd4e"},{"url":"https://git.kernel.org/stable/c/110b765744b147c63882f5e9cb12931c5dc8d85f"},{"url":"https://git.kernel.org/stable/c/4bb84e964ff0fe0a171c965362de72f9820dbce9"},{"url":"https://git.kernel.org/stable/c/3ab32218d7182705dae5c86f13925f458072da2c"},{"url":"https://git.kernel.org/stable/c/c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa"},{"url":"https://git.kernel.org/stable/c/06213c85d8c0994f786c093b8b2a517987943ca6"},{"url":"https://git.kernel.org/stable/c/ec4215683e47424c9c4762fd3c60f552a3119142"}],"title":"ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF","x_generator":{"engine":"bippy-1.2.0"}}}}