CVE-2026-68121

A flaw was found in the Linux kernel's PPPoE (Point-to-Point Protocol over Ethernet) implementation. This vulnerability occurs because a pointer to network packet data is not updated after memory is reallocated, leading to the use of an outdated memory address. An attacker with local access could potentially trigger this condition, causing memory corruption. This could result in a system crash (denial of service) or other unpredictable system behavior.

This vulnerability is rated as an Important severity flaw because an authenticated local user can exploit a use-after-free condition to corrupt kernel memory, potentially achieving local privilege escalation or crashing the operating system. Although triggering the issue requires specific timing during packet transmission and network device manipulation, the potential blast radius involves compromise of kernel memory. Enterprise Red Hat Enterprise Linux installations rarely configure PPPoE interfaces, which significantly limits practical exposure in default environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

See the security bulletin for a detailed mitigation procedure.