369 lines
19 KiB
JSON
369 lines
19 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-68398",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-07-30T09:28:09.389Z",
|
|
"datePublished": "2026-08-10T12:04:17.771Z",
|
|
"dateUpdated": "2026-10-19T21:09:08.443Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-19T16:34:49.839Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF\n\npppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:\n\n l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv()\n -> ppp_input(&po->chan)\n\nIt runs under rcu_read_lock() holding only an l2tp_session reference and\ntakes NO reference on the internal PPP channel (struct channel,\nchan->ppp) that ppp_input() dereferences.\n\nThe pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel\nare RCU-safe. But the internal struct channel is a separate allocation\nthat ppp_release_channel() frees with a plain kfree():\n\n close(data socket) -> pppol2tp_release() -> pppox_unbind_sock()\n -> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch)\n\nFor a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit\n(no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips\nboth ppp_disconnect_channel()'s synchronize_net() and\nppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace\nperiod. rcu_read_lock() in pppol2tp_recv() does not protect against a\nplain kfree(), so an in-flight ppp_input() on one CPU can dereference\nthe channel just freed by close() on another CPU.\n\nThe bug is reachable by an unprivileged user.\n\nDefer the channel free to an RCU callback via call_rcu() so the grace\nperiod fences any in-flight ppp_input(). The disconnect and unbridge\nteardown paths already fence with synchronize_net()/synchronize_rcu();\ncall_rcu() does the same here without stalling the close() path."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The free side of the race is a local close() of the pppol2tp socket, which no remote peer can invoke; the full attack (create tunnel/session via AF_PPPOX socket, drive RX with loopback UDP datagrams, close concurrently) is performed entirely through local syscalls.\nAC:L - The attacker controls both sides of the race, feeding the UDP-encap RX softirq from one thread while closing the pppox socket on another, and can retry the loop indefinitely until the window is hit.\nPR:L - No capability check exists on this path: pppox_create()/pppol2tp_connect() and ppp_register_net_channel() need no CAP_NET_ADMIN, and PPPIOCGCHAN is handled by pppox_ioctl() on the socket itself, so /dev/ppp access is not required; the fix commit states the bug is reachable by an unprivileged user.\nUI:N - The attacker performs every step — socket creation, session setup, packet injection and close() — with no action by any other user or administrator.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After the channel is freed and its slab object reallocated, ppp_input() reads pch->bridge and pch->ppp from attacker-groomed memory and can route received frames to an arbitrary attacker-chosen structure, giving a path to disclosing kernel memory.\nI:H - skb_queue_tail(&pch->file.rq, skb) writes a linked-list insertion into the freed object and wake_up_interruptible(&pch->file.rwait) traverses a freed waitqueue, so heap grooming yields controlled writes and function-pointer traversal usable for privilege escalation.\nA:H - Dereferencing and writing to the kfree()d struct channel from softirq context reliably corrupts the slab and panics or oopses the kernel, and the race can be re-triggered at will."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ppp/ppp_generic.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
|
|
"lessThan": "4e47f1ac188ece11d6fdabe44166a2776cc5bd4e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
|
|
"lessThan": "110b765744b147c63882f5e9cb12931c5dc8d85f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
|
|
"lessThan": "4bb84e964ff0fe0a171c965362de72f9820dbce9",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
|
|
"lessThan": "3ab32218d7182705dae5c86f13925f458072da2c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
|
|
"lessThan": "c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
|
|
"lessThan": "06213c85d8c0994f786c093b8b2a517987943ca6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
|
|
"lessThan": "ec4215683e47424c9c4762fd3c60f552a3119142",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d36e5ba7bbed5d7bd26e8609ffed503c2def401b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "9bcc0508576b2d50efd958f2ea1c5906749c2c89",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "c2984681fe15cfb803a9132aaaf1140ab20a72c1",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5803ecd7f6ac6f747582e775caa62ac9d0489261",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "26f8819ddd10141ebe7bbce700fbab36bfa5f478",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "3.2.99",
|
|
"lessThan": "3.3",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "3.16.54",
|
|
"lessThan": "3.17",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.4.225",
|
|
"lessThan": "4.5",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.9.225",
|
|
"lessThan": "4.10",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.14.182",
|
|
"lessThan": "4.15",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ppp/ppp_generic.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.216",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.183",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.148",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.101",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.42",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1.6",
|
|
"lessThanOrEqual": "7.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.15",
|
|
"versionEndExcluding": "5.15.216"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.15",
|
|
"versionEndExcluding": "6.1.183"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.15",
|
|
"versionEndExcluding": "6.6.148"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.15",
|
|
"versionEndExcluding": "6.12.101"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.15",
|
|
"versionEndExcluding": "6.18.42"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.15",
|
|
"versionEndExcluding": "7.1.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.15",
|
|
"versionEndExcluding": "7.2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.2.99"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.16.54"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.4.225"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.9.225"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.14.182"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4e47f1ac188ece11d6fdabe44166a2776cc5bd4e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/110b765744b147c63882f5e9cb12931c5dc8d85f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4bb84e964ff0fe0a171c965362de72f9820dbce9"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3ab32218d7182705dae5c86f13925f458072da2c"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/06213c85d8c0994f786c093b8b2a517987943ca6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ec4215683e47424c9c4762fd3c60f552a3119142"
|
|
}
|
|
],
|
|
"title": "ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2026-68398",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-16T15:48:09.975001Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"type": "CWE",
|
|
"cweId": "CWE-416",
|
|
"description": "CWE-416 Use After Free"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-19T21:09:08.443Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |