{"id":"CVE-2026-68398","state":"PUBLISHED","title":"ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF\n\npppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:\n\n l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv()\n   -> ppp_input(&po->chan)\n\nIt runs under rcu_read_lock() holding only an l2tp_session reference and\ntakes NO reference on the internal PPP channel (struct channel,\nchan->ppp) that ppp_input() dereferences.\n\nThe pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel\nare RCU-safe.  But the internal struct channel is a separate allocation\nthat ppp_release_channel() frees with a plain kfree():\n\n close(data socket) -> pppol2tp_release() -> pppox_unbind_sock()\n   -> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch)\n\nFor a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit\n(no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips\nboth ppp_disconnect_channel()'s synchronize_net() and\nppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace\nperiod.  rcu_read_lock() in pppol2tp_recv() does not protect against a\nplain kfree(), so an in-flight ppp_input() on one CPU can dereference\nthe channel just freed by close() on another CPU.\n\nThe bug is reachable by an unprivileged user.\n\nDefer the channel free to an RCU callback via call_rcu() so the grace\nperiod fences any in-flight ppp_input(). The disconnect and unbridge\nteardown paths already fence with synchronize_net()/synchronize_rcu();\ncall_rcu() does the same here without stalling the close() path.","publishedAt":"2026-08-10T12:04:17.771Z","updatedAt":"2026-10-19T21:09:08.443Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","status":"affected","lessThan":"4e47f1ac188ece11d6fdabe44166a2776cc5bd4e","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","status":"affected","lessThan":"110b765744b147c63882f5e9cb12931c5dc8d85f","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","status":"affected","lessThan":"4bb84e964ff0fe0a171c965362de72f9820dbce9","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","status":"affected","lessThan":"3ab32218d7182705dae5c86f13925f458072da2c","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","status":"affected","lessThan":"c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","status":"affected","lessThan":"06213c85d8c0994f786c093b8b2a517987943ca6","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","status":"affected","lessThan":"ec4215683e47424c9c4762fd3c60f552a3119142","versionType":"git"},{"version":"d36e5ba7bbed5d7bd26e8609ffed503c2def401b","status":"affected","versionType":"git"},{"version":"9bcc0508576b2d50efd958f2ea1c5906749c2c89","status":"affected","versionType":"git"},{"version":"c2984681fe15cfb803a9132aaaf1140ab20a72c1","status":"affected","versionType":"git"},{"version":"5803ecd7f6ac6f747582e775caa62ac9d0489261","status":"affected","versionType":"git"},{"version":"26f8819ddd10141ebe7bbce700fbab36bfa5f478","status":"affected","versionType":"git"},{"version":"3.2.99","status":"affected","lessThan":"3.3","versionType":"semver"},{"version":"3.16.54","status":"affected","lessThan":"3.17","versionType":"semver"},{"version":"4.4.225","status":"affected","lessThan":"4.5","versionType":"semver"},{"version":"4.9.225","status":"affected","lessThan":"4.10","versionType":"semver"},{"version":"4.14.182","status":"affected","lessThan":"4.15","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ppp/ppp_generic.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.15","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ppp/ppp_generic.c"]}],"references":["https://git.kernel.org/stable/c/4e47f1ac188ece11d6fdabe44166a2776cc5bd4e","https://git.kernel.org/stable/c/110b765744b147c63882f5e9cb12931c5dc8d85f","https://git.kernel.org/stable/c/4bb84e964ff0fe0a171c965362de72f9820dbce9","https://git.kernel.org/stable/c/3ab32218d7182705dae5c86f13925f458072da2c","https://git.kernel.org/stable/c/c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa","https://git.kernel.org/stable/c/06213c85d8c0994f786c093b8b2a517987943ca6","https://git.kernel.org/stable/c/ec4215683e47424c9c4762fd3c60f552a3119142"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68398.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68398","state":"PUBLISHED","datePublished":"2026-08-10T12:04:17.771Z","dateUpdated":"2026-10-19T21:09:08.443Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.389Z"},"containers":{"cna":{"title":"ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF\n\npppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:\n\n l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv()\n   -> ppp_input(&po->chan)\n\nIt runs under rcu_read_lock() holding only an l2tp_session reference and\ntakes NO reference on the internal PPP channel (struct channel,\nchan->ppp) that ppp_input() dereferences.\n\nThe pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel\nare RCU-safe.  But the internal struct channel is a separate allocation\nthat ppp_release_channel() frees with a plain kfree():\n\n close(data socket) -> pppol2tp_release() -> pppox_unbind_sock()\n   -> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch)\n\nFor a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit\n(no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips\nboth ppp_disconnect_channel()'s synchronize_net() and\nppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace\nperiod.  rcu_read_lock() in pppol2tp_recv() does not protect against a\nplain kfree(), so an in-flight ppp_input() on one CPU can dereference\nthe channel just freed by close() on another CPU.\n\nThe bug is reachable by an unprivileged user.\n\nDefer the channel free to an RCU callback via call_rcu() so the grace\nperiod fences any in-flight ppp_input(). The disconnect and unbridge\nteardown paths already fence with synchronize_net()/synchronize_rcu();\ncall_rcu() does the same here without stalling the close() path."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","status":"affected","lessThan":"4e47f1ac188ece11d6fdabe44166a2776cc5bd4e","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","status":"affected","lessThan":"110b765744b147c63882f5e9cb12931c5dc8d85f","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","status":"affected","lessThan":"4bb84e964ff0fe0a171c965362de72f9820dbce9","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","status":"affected","lessThan":"3ab32218d7182705dae5c86f13925f458072da2c","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","status":"affected","lessThan":"c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","status":"affected","lessThan":"06213c85d8c0994f786c093b8b2a517987943ca6","versionType":"git"},{"version":"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741","status":"affected","lessThan":"ec4215683e47424c9c4762fd3c60f552a3119142","versionType":"git"},{"version":"d36e5ba7bbed5d7bd26e8609ffed503c2def401b","status":"affected","versionType":"git"},{"version":"9bcc0508576b2d50efd958f2ea1c5906749c2c89","status":"affected","versionType":"git"},{"version":"c2984681fe15cfb803a9132aaaf1140ab20a72c1","status":"affected","versionType":"git"},{"version":"5803ecd7f6ac6f747582e775caa62ac9d0489261","status":"affected","versionType":"git"},{"version":"26f8819ddd10141ebe7bbce700fbab36bfa5f478","status":"affected","versionType":"git"},{"version":"3.2.99","status":"affected","lessThan":"3.3","versionType":"semver"},{"version":"3.16.54","status":"affected","lessThan":"3.17","versionType":"semver"},{"version":"4.4.225","status":"affected","lessThan":"4.5","versionType":"semver"},{"version":"4.9.225","status":"affected","lessThan":"4.10","versionType":"semver"},{"version":"4.14.182","status":"affected","lessThan":"4.15","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ppp/ppp_generic.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.15","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ppp/ppp_generic.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/4e47f1ac188ece11d6fdabe44166a2776cc5bd4e"},{"url":"https://git.kernel.org/stable/c/110b765744b147c63882f5e9cb12931c5dc8d85f"},{"url":"https://git.kernel.org/stable/c/4bb84e964ff0fe0a171c965362de72f9820dbce9"},{"url":"https://git.kernel.org/stable/c/3ab32218d7182705dae5c86f13925f458072da2c"},{"url":"https://git.kernel.org/stable/c/c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa"},{"url":"https://git.kernel.org/stable/c/06213c85d8c0994f786c093b8b2a517987943ca6"},{"url":"https://git.kernel.org/stable/c/ec4215683e47424c9c4762fd3c60f552a3119142"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The free side of the race is a local close() of the pppol2tp socket, which no remote peer can invoke; the full attack (create tunnel/session via AF_PPPOX socket, drive RX with loopback UDP datagrams, close concurrently) is performed entirely through local syscalls.\nAC:L - The attacker controls both sides of the race, feeding the UDP-encap RX softirq from one thread while closing the pppox socket on another, and can retry the loop indefinitely until the window is hit.\nPR:L - No capability check exists on this path: pppox_create()/pppol2tp_connect() and ppp_register_net_channel() need no CAP_NET_ADMIN, and PPPIOCGCHAN is handled by pppox_ioctl() on the socket itself, so /dev/ppp access is not required; the fix commit states the bug is reachable by an unprivileged user.\nUI:N - The attacker performs every step — socket creation, session setup, packet injection and close() — with no action by any other user or administrator.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After the channel is freed and its slab object reallocated, ppp_input() reads pch->bridge and pch->ppp from attacker-groomed memory and can route received frames to an arbitrary attacker-chosen structure, giving a path to disclosing kernel memory.\nI:H - skb_queue_tail(&pch->file.rq, skb) writes a linked-list insertion into the freed object and wake_up_interruptible(&pch->file.rwait) traverses a freed waitqueue, so heap grooming yields controlled writes and function-pointer traversal usable for privilege escalation.\nA:H - Dereferencing and writing to the kfree()d struct channel from softirq context reliably corrupts the slab and panics or oopses the kernel, and the race can be re-triggered at will."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-19T16:34:49.839Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.99"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.225"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.225"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.182"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-68398","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:48:09.975001Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T21:09:08.443Z"}}]}}}