CVE-2026-68398

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An unprivileged user can trigger a Use-After-Free (UAF) condition in the Linux kernel. The issue occurs in the pppol2tp recv() function during the L2TP UDP-encap softirq RX path. While the function runs under rcu read lock(), it fails to take a reference on the internal PPP channel (struct channel, chan->ppp) that ppp input() dereferences. Because the internal channel is freed using a plain kfree() in ppp release channel() without a grace period during certain teardown paths, a concurrent ppp input() execution on one CPU may dereference a channel that has already been freed by a close() operation on another CPU.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.