CVE-2026-68121

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the pppoe sendmsg() function where a pointer to the PPPoE header is saved before calling dev hard header(). Because device header callbacks can reallocate the skb head, any previously saved pointers into it may become invalid. This occurs when a send operation is blocked in copy from user() while a non-Ethernet port is added to an empty team device, causing the GRE header callback to expand the skb head. Consequently, PPPoE writes six bytes using a stale pointer into the freed head memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.