CVE-2026-68398 - Vulnerability Details

- ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

Description

In the Linux kernel, the following vulnerability has been resolved:

ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:

l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv()
-> ppp_input(&po->chan)

It runs under rcu_read_lock() holding only an l2tp_session reference and
takes NO reference on the internal PPP channel (struct channel,
chan->ppp) that ppp_input() dereferences.

The pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel
are RCU-safe. But the internal struct channel is a separate allocation
that ppp_release_channel() frees with a plain kfree():

close(data socket) -> pppol2tp_release() -> pppox_unbind_sock()
-> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch)

For a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit
(no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips
both ppp_disconnect_channel()'s synchronize_net() and
ppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace
period. rcu_read_lock() in pppol2tp_recv() does not protect against a
plain kfree(), so an in-flight ppp_input() on one CPU can dereference
the channel just freed by close() on another CPU.

The bug is reachable by an unprivileged user.

Defer the channel free to an RCU callback via call_rcu() so the grace
period fences any in-flight ppp_input(). The disconnect and unbridge
teardown paths already fence with synchronize_net()/synchronize_rcu();
call_rcu() does the same here without stalling the close() path.

Published: 2026-08-10

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A use‑after‑free flaw exists in the PPP over L2TP UDP encapsulation code path in the Linux kernel, identified by CWE‑825. When an L2TP UDP socket that is bound to a PPP channel is closed while the channel is still being processed in the receive routine, the channel memory is freed without a proper grace period. An in‑flight read can subsequently dereference this freed memory, leading to a crash or, if an attacker can control the freed contents, execution of arbitrary code.

Affected Systems

The defect applies to any Linux kernel that includes the PPP over L2TP UDP functionality. No specific kernel release is excluded in the advisory, so all kernels with that feature compiled into the system are potentially vulnerable, regardless of patch level.

Risk and Exploitability

The CVSS score of 7.8 reflects a substantial impact, while the EPSS score of less than 1% and lack of inclusion in CISA’s KEV catalog indicate a low current exploitation probability. The vulnerability is locally available to unprivileged users and requires a race condition between closing a socket and an ongoing receive handler, making exploitation challenging but not impossible for an attacker with sufficient local access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741`	affected	< 4e47f1ac188ece11d6fdabe44166a2776cc5bd4e
`ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741`	affected	< 110b765744b147c63882f5e9cb12931c5dc8d85f
`ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741`	affected	< 4bb84e964ff0fe0a171c965362de72f9820dbce9
`ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741`	affected	< 3ab32218d7182705dae5c86f13925f458072da2c
`ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741`	affected	< c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa
`ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741`	affected	< 06213c85d8c0994f786c093b8b2a517987943ca6
`ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741`	affected	< ec4215683e47424c9c4762fd3c60f552a3119142
`d36e5ba7bbed5d7bd26e8609ffed503c2def401b`	affected	—
`9bcc0508576b2d50efd958f2ea1c5906749c2c89`	affected	—
`c2984681fe15cfb803a9132aaaf1140ab20a72c1`	affected	—
`5803ecd7f6ac6f747582e775caa62ac9d0489261`	affected	—
`26f8819ddd10141ebe7bbce700fbab36bfa5f478`	affected	—
`3.2.99`	affected	< 3.3
`3.16.54`	affected	< 3.17
`4.4.225`	affected	< 4.5
`4.9.225`	affected	< 4.10
`4.14.182`	affected	< 4.15

Linux

affected

Version	Status	Constraints
`4.15`	affected	—
`0`	unaffected	< 4.15
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741,4bb84e964ff0fe0a171c965362de72f9820dbce9)`	affected	code_commit	—
`[ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741,3ab32218d7182705dae5c86f13925f458072da2c)`	affected	code_commit	—
`[ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741,c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa)`	affected	code_commit	—
`[ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741,06213c85d8c0994f786c093b8b2a517987943ca6)`	affected	code_commit	—
`[ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741,ec4215683e47424c9c4762fd3c60f552a3119142)`	affected	code_commit	—
`[d36e5ba7bbed5d7bd26e8609ffed503c2def401b,*]`	affected	code_commit	—
`[9bcc0508576b2d50efd958f2ea1c5906749c2c89,*]`	affected	code_commit	—
`[c2984681fe15cfb803a9132aaaf1140ab20a72c1,*]`	affected	code_commit	—
`[5803ecd7f6ac6f747582e775caa62ac9d0489261,*]`	affected	code_commit	—
`[26f8819ddd10141ebe7bbce700fbab36bfa5f478,*]`	affected	code_commit	—
`[3.2.99,3.3)`	affected	semver	—
`[3.16.54,3.17)`	affected	semver	—
`[4.4.225,4.5)`	affected	semver	—
`[4.9.225,4.10)`	affected	semver	—
`[4.14.182,4.15)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.15`	affected	generic	—
`[0,4.15)`	unaffected	semver	—
`[6.6.148,6.6.*]`	unaffected	semver	—
`[6.12.101,6.12.*]`	unaffected	semver	—
`[6.18.42,6.18.*]`	unaffected	semver	—
`[7.1.6,7.1.*]`	unaffected	semver	—
`[7.2-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a release that contains the fix for the PPP over L2TP UDP use‑after‑free bug.
If a kernel upgrade is not immediately possible, disable or block L2TP UDP encapsulation to prevent the vulnerable code from executing.
Restrict access to PPP devices and L2TP sockets so that unprivileged users cannot open or close them.
Apply the patch that defers channel freeing to an RCU callback to enforce a safe grace period.

Generated by OpenCVE AI on August 14, 2026 at 01:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00195.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/06213c85d8c0994f786c093b8b2a517987943ca6
https://git.kernel.org/stable/c/110b765744b147c63882f5e9cb12931c5dc8d85f
https://git.kernel.org/stable/c/3ab32218d7182705dae5c86f13925f458072da2c
https://git.kernel.org/stable/c/4bb84e964ff0fe0a171c965362de72f9820dbce9
https://git.kernel.org/stable/c/4e47f1ac188ece11d6fdabe44166a2776cc5bd4e
https://git.kernel.org/stable/c/c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa
https://git.kernel.org/stable/c/ec4215683e47424c9c4762fd3c60f552a3119142
https://nvd.nist.gov/vuln/detail/CVE-2026-68398
https://www.cve.org/CVERecord?id=CVE-2026-68398

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/110b765744b147c63882f5e9cb12931c5dc8d85f https://git.kernel.org/stable/c/4e47f1ac188ece11d6fdabe44166a2776cc5bd4e

Thu, 13 Aug 2026 23:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 12 Aug 2026 20:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68398 https://www.cve.org/CVERecord?id=CVE-2026-68398
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Mon, 10 Aug 2026 16:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path: l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv() -> ppp_input(&po->chan) It runs under rcu_read_lock() holding only an l2tp_session reference and takes NO reference on the internal PPP channel (struct channel, chan->ppp) that ppp_input() dereferences. The pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel are RCU-safe. But the internal struct channel is a separate allocation that ppp_release_channel() frees with a plain kfree(): close(data socket) -> pppol2tp_release() -> pppox_unbind_sock() -> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch) For a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit (no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips both ppp_disconnect_channel()'s synchronize_net() and ppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace period. rcu_read_lock() in pppol2tp_recv() does not protect against a plain kfree(), so an in-flight ppp_input() on one CPU can dereference the channel just freed by close() on another CPU. The bug is reachable by an unprivileged user. Defer the channel free to an RCU callback via call_rcu() so the grace period fences any in-flight ppp_input(). The disconnect and unbridge teardown paths already fence with synchronize_net()/synchronize_rcu(); call_rcu() does the same here without stalling the close() path.
Title		ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/06213c85d8c0994f786c093b8b2a517987943ca6 https://git.kernel.org/stable/c/3ab32218d7182705dae5c86f13925f458072da2c https://git.kernel.org/stable/c/4bb84e964ff0fe0a171c965362de72f9820dbce9 https://git.kernel.org/stable/c/c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa https://git.kernel.org/stable/c/ec4215683e47424c9c4762fd3c60f552a3119142

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:04:17.771Z

Updated: 2026-08-19T16:34:49.839Z

Reserved: 2026-07-30T09:28:09.389Z

Link: CVE-2026-68398

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:20:33.243

Modified: 2026-08-19T17:20:47.860

Link: CVE-2026-68398

Redhat

Severity : Important

Publid Date: 2026-08-10T12:04:17Z

Links: CVE-2026-68398 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-14T02:00:15Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object