pppoe: reload header pointer after dev_hard_header() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.37 % · percentile 31 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after dev_hard_header() pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This can happen when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head. Reload the PPPoE header through the skb's network-header offset after device header creation. pskb_expand_head() updates that offset when it relocates the head.
Weaknesses (CWE)
- CWE-416 — Use After Free
References
- https://git.kernel.org/stable/c/7a56e7c9b08e08fd55a1bcada24cf4fe3782b722
- https://git.kernel.org/stable/c/6eed5ae7887a93160803d2b81ff88e75eefd4a4c
- https://git.kernel.org/stable/c/ba3409369c5413cdf0dcbf3a928f76b48e8c3e6a
- https://git.kernel.org/stable/c/e6493a4d1ee17595766165fa446d45b7e0c318d0
- https://git.kernel.org/stable/c/7e9fbd7f96bcde63a7c798fe16b38cedee7a1501
- https://git.kernel.org/stable/c/6866abf59976d273164a6624234d96a967280223
- https://git.kernel.org/stable/c/bed4caecd723693f750e13adbb2c42ca1249a3fd
- https://git.kernel.org/stable/c/e9c238f6fe42fb1b4dba3a578277de32cb487937
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-55502
- GCVE · GCVE-0-2026-68121
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1335 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1288 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1255 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1254 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1231 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1230 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1202 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1164 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1163 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1069 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7a56e7c9b08e08fd55a1bcada24cf4fe3782b722 ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6eed5ae7887a93160803d2b81ff88e75eefd4a4c ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ba3409369c5413cdf0dcbf3a928f76b48e8c3e6a ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < e6493a4d1ee17595766165fa446d45b7e0c318d0 ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7e9fbd7f96bcde63a7c798fe16b38cedee7a1501 ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6866abf59976d273164a6624234d96a967280223 |
| Linux · Linux | affected 2.6.12 ; unaffected 0 < 2.6.12 ; unaffected 5.10.265 ≤ 5.10.* ; unaffected 5.15.216 ≤ 5.15.* ; unaffected 6.1.183 ≤ 6.1.* ; unaffected 6.6.148 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |