CVE-2026-68121

HighCVSS 7.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

pppoe: reload header pointer after dev_hard_header()

pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it.

This can happen when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head.

Reload the PPPoE header through the skb's network-header offset after device header creation. pskb_expand_head() updates that offset when it relocates the head.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 7a56e7c9b08e08fd55a1bcada24cf4fe3782b722; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 6eed5ae7887a93160803d2b81ff88e75eefd4a4c; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < ba3409369c5413cdf0dcbf3a928f76b48e8c3e6a; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < e6493a4d1ee17595766165fa446d45b7e0c318d0; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 7e9fbd7f96bcde63a7c798fe16b38cedee7a1501; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 6866abf59976d273164a6624234d96a967280223; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < bed4caecd723693f750e13adbb2c42ca1249a3fd; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < e9c238f6fe42fb1b4dba3a578277de32cb487937
LinuxLinux2.6.12

References

Timeline

Published
Aug 10, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-68122In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RXCVE-2026-681239.8In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRCVE-2026-681249.6In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow CVE-2026-681258.8In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llCVE-2026-68126In the Linux kernel, the following vulnerability has been resolved: mac802154: hold an interface reference across the scan worker mac80215CVE-2026-681279.8In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskb_may_pull in checksum adjust ila_csuCVE-2026-681288.8In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_profile_init set_bit(rsltCVE-2026-681297.5In the Linux kernel, the following vulnerability has been resolved: gve: fix Rx queue stall on alloc failure When the system is under extrCVE-2026-68134.4The Continually plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4CVE-2026-68130In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer destroy_previous_session() until after NTLM authenticationCVE-2026-681317.5In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In CVE-2026-68132In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices do_thaw_all
CVE-2026-68121: High severity, CVSS 7.8 | Vulnix