{"id":"CVE-2026-68398","revision":"97a02ea21c2141929442ce3eb5748b34","records":[{"revision":"97a02ea21c2141929442ce3eb5748b34","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68398","aliases":[],"title":"ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF\n\npppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:\n\n l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv()\n   -> ppp_input(&po->chan)\n\nIt runs under rcu_read_lock() holding only an l2tp_session reference and\ntakes NO reference on the internal PPP channel (struct channel,\nchan->ppp) that ppp_input() dereferences.\n\nThe pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel\nare RCU-safe.  But the internal struct channel is a separate allocation\nthat ppp_release_channel() frees with a plain kfree():\n\n close(data socket) -> pppol2tp_release() -> pppox_unbind_sock()\n   -> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch)\n\nFor a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit\n(no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips\nboth ppp_disconnect_channel()'s synchronize_net() and\nppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace\nperiod.  rcu_read_lock() in pppol2tp_recv() does not protect against a\nplain kfree(), so an in-flight ppp_input() on one CPU can dereference\nthe channel just freed by close() on another CPU.\n\nThe bug is reachable by an unprivileged user.\n\nDefer the channel free to an RCU callback via call_rcu() so the grace\nperiod fences any in-flight ppp_input(). The disconnect and unbridge\nteardown paths already fence with synchronize_net()/synchronize_rcu();\ncall_rcu() does the same here without stalling the close() path.","state":0,"publishedAt":"2026-08-10T12:04:17.771+00:00","modifiedAt":"2026-10-19T21:09:08.443+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ppp/ppp_generic.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741\",\n                            \"lessThan\": \"4e47f1ac188ece11d6fdabe44166a2776cc5bd4e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741\",\n                            \"lessThan\": \"110b765744b147c63882f5e9cb12931c5dc8d85f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741\",\n                            \"lessThan\": \"4bb84e964ff0fe0a171c965362de72f9820dbce9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741\",\n                            \"lessThan\": \"3ab32218d7182705dae5c86f13925f458072da2c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741\",\n                            \"lessThan\": \"c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741\",\n                            \"lessThan\": \"06213c85d8c0994f786c093b8b2a517987943ca6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741\",\n                            \"lessThan\": \"ec4215683e47424c9c4762fd3c60f552a3119142\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d36e5ba7bbed5d7bd26e8609ffed503c2def401b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9bcc0508576b2d50efd958f2ea1c5906749c2c89\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c2984681fe15cfb803a9132aaaf1140ab20a72c1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5803ecd7f6ac6f747582e775caa62ac9d0489261\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"26f8819ddd10141ebe7bbce700fbab36bfa5f478\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3.2.99\",\n                            \"lessThan\": \"3.3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"3.16.54\",\n                            \"lessThan\": \"3.17\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.4.225\",\n                            \"lessThan\": \"4.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.9.225\",\n                            \"lessThan\": \"4.10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.14.182\",\n                            \"lessThan\": \"4.15\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ppp/ppp_generic.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.148\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.101\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.42\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/4e47f1ac188ece11d6fdabe44166a2776cc5bd4e","https://git.kernel.org/stable/c/110b765744b147c63882f5e9cb12931c5dc8d85f","https://git.kernel.org/stable/c/4bb84e964ff0fe0a171c965362de72f9820dbce9","https://git.kernel.org/stable/c/3ab32218d7182705dae5c86f13925f458072da2c","https://git.kernel.org/stable/c/c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa","https://git.kernel.org/stable/c/06213c85d8c0994f786c093b8b2a517987943ca6","https://git.kernel.org/stable/c/ec4215683e47424c9c4762fd3c60f552a3119142"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68398","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68398","identifiers":["CVE-2026-68398"]},"retained":false,"historicalAffected":[]}],"coverage":[]}