Executive brief
The Linux kernel's PPPoE (Point-to-Point Protocol over Ethernet) networking implementation contains a use-after-free vulnerability in the message sending function. An attacker with the ability to add network interfaces to a team device and trigger concurrent send operations could cause kernel memory corruption, leading to system crashes or potential privilege escalation. This affects systems using PPPoE for connectivity, such as ISP customers and network administrators.
Technical details
The vulnerability is a use-after-free bug in the PPPoE send path (pppoe_sendmsg). The function stores a pointer to the PPPoE header structure before calling dev_hard_header(), which is allowed to reallocate the socket buffer (skb) head, invalidating the saved pointer. When a team device with a GRE callback expands the skb head during a concurrent send operation blocked in copy_from_user(), the subsequent memcpy writes six bytes through the stale pointer into freed kernel memory. The fix reloads the PPPoE header pointer after dev_hard_header() returns, using the skb's network-header offset which is correctly maintained by pskb_expand_head(). The vulnerability exists since Linux 2.6.12. Patches are available in the upstream kernel and stable branches.
Affected products
- Linux Linux Kernel 2.6.12 through at least 6.x (all versions until patched)
Timeline
- 2026-08-10: disclosed: Published to NVD
- 2026-07-22: patched: Upstream commit e9c238f6fe42fb1b4dba3a578277de32cb487937
- 2026-08-03: patched: Backported to Linux 6.x stable
- 2026-08-19: patched: Backported to additional stable branches