CVE-2026-68398

ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

EIP currently links 1 repository PoC to CVE-2026-68398.

Description

In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path: l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv() -> ppp_input(&po->chan) It runs under rcu_read_lock() holding only an l2tp_session reference and takes NO reference on the internal PPP channel (struct channel, chan->ppp) that ppp_input() dereferences. The pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel are RCU-safe. But the internal struct channel is a separate allocation that ppp_release_channel() frees with a plain kfree(): close(data socket) -> pppol2tp_release() -> pppox_unbind_sock() -> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch) For a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit (no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips both ppp_disconnect_channel()'s synchronize_net() and ppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace period. rcu_read_lock() in pppol2tp_recv() does not protect against a plain kfree(), so an in-flight ppp_input() on one CPU can dereference the channel just freed by close() on another CPU. The bug is reachable by an unprivileged user. Defer the channel free to an RCU callback via call_rcu() so the grace period fences any in-flight ppp_input(). The disconnect and unbridge teardown paths already fence with synchronize_net()/synchronize_rcu(); call_rcu() does the same here without stalling the close() path.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

Affected products and versions

2
ProductSourceVersion range

Linux

Browse Linux / Linux

Default status: unaffected, affected

CVE Listee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 to < 4bb84e964ff0fe0a171c965362de72f9820dbce9affected
ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 to < 3ab32218d7182705dae5c86f13925f458072da2caffected
ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 to < c9574b8a8edeb4edd3ac6472c27ef7184bdb2baaaffected
ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 to < 06213c85d8c0994f786c093b8b2a517987943ca6affected
ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 to < ec4215683e47424c9c4762fd3c60f552a3119142affected
d36e5ba7bbed5d7bd26e8609ffed503c2def401baffected
9bcc0508576b2d50efd958f2ea1c5906749c2c89affected
c2984681fe15cfb803a9132aaaf1140ab20a72c1affected
5803ecd7f6ac6f747582e775caa62ac9d0489261affected
26f8819ddd10141ebe7bbce700fbab36bfa5f478affected
3.2.99 to < 3.3affected
3.16.54 to < 3.17affected
Showing 12 of 22 version ranges

Kernel

Browse Linux / Kernel
OSV4.15.0 to < 6.6.148 · Fixed in 6.6.148affected
6.7.0 to < 6.12.101 · Fixed in 6.12.101affected
6.13.0 to < 6.18.42 · Fixed in 6.18.42affected
6.19.0 to < 7.1.6 · Fixed in 7.1.6affected

Proofs of concept

1

Repository PoCs

GitHubaramosf/CVE-2026-68398Repository PoCby aramosf0Exploit14 files

1.3 MiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A local privilege escalation exploit for CVE-2026-68398 targeting Ubuntu 22.04 with kernel 5.15.0-187-generic. It exploits a use-after-free race condition in the PPPoL2TP receive path by racing channel creation/destruction with user-key payloads to reclaim freed memory, forge credentials, and install a SUID root helper.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README, Makefile, and exploit.c source code for a local privilege escalation exploit targeting CVE-2026-68398. The code performs kernel heap manipulation, race condition exploitation, and credential forging to gain root privileges, which is the expected behavior of a PoC exploit for this vulnerability. No concealed backdoor, unrelated payload, or deceptive operator-directed harm was observed. The exploit installs a temporary SUID helper to transition to root, which is a standard technique for converting kernel-level credential changes into a persistent process with elevated privileges, and is fully disclosed in the README and source code.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesc
Target softwareLinux kernelUbuntu 22.04ppp_generic.cpppol2tp
Attack typesuse-after-freerace conditionlocal privilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains complete, compilable C source code (exploit.c) that exercises the CVE-2026-68398 vulnerability to achieve local privilege escalation from an unprivileged user to root. The README documents a successful end-to-end exploitation chain, and the code includes all stages: race triggering, heap spraying, pointer leaking, credential forgery, and SUID helper installation. This is an exploit, not a scanner or writeup.

exploit.c:1-906README.md:1-223

Requirements

  • Target must be Ubuntu 22.04 with exact kernel release 5.15.0-187-generic.exploit.c:644-650
  • KASLR must be enabled; the exploit includes a prefetch-based KASLR bypass that requires RDTSCP and KPTI inactive.README.md:101-108
  • The l2tp_ppp kernel module must be available (autoloaded by the exploit).README.md:81-86
  • The user must be able to create PPPoL2TP sockets and user keys.exploit.c:151-172exploit.c:407-408

Observed behavior

  • Creates multiple threads that repeatedly create and close PPPoL2TP channels while sending L2TPv2/PPP frames to trigger the UAF race.exploit.c:392-486
  • Uses user-key payloads to reclaim the freed struct channel and control its skb queue and waitqueue fields.exploit.c:451-458
  • Leaks kernel heap pointers (skb, key object) through the readable key payload and /proc/sys/kernel/core_pattern.exploit.c:729-760
  • Constructs a fake credential structure inside a key payload, including UID 0, full capabilities, and valid init namespace pointers.exploit.c:188-219
  • Injects a fake AppArmor credential blob pointer and an unconfined label into the forged credential.exploit.c:817-888
  • Triggers override_creds() via a crafted waitqueue callback to gain root privileges, then copies /proc/self/exe to a SUID root helper and executes it to obtain persistent root.exploit.c:894-905exploit.c:258-340
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Temporary Suid Helper
/tmp/.cve-2026-68398-root-<pid>The exploit creates a temporary SUID root copy of itself to transition from kernel-level credential override to a user-space root process. This is a disclosed, necessary step for the exploit to function and is not a backdoor.exploit.c:258-318exploit.c:894-905README.md:126-134
Kernel Credential Forgery
Fake cred structure with uid=0, gid=0, full capabilitiesThe exploit forges a kernel credential structure to gain root privileges. This is the core mechanism of the privilege escalation and is consistent with the described vulnerability.exploit.c:188-219
Review boundaries

What the analysis did not establish

  • The evidence includes only three text files (Makefile, README.md, exploit.c) out of 14 total files; 10 files are unclassified and one is non-text media, so the full repository content is not available for analysis.
  • The exploit is build-specific and targets only one exact Ubuntu kernel build (5.15.0-187-generic); it is not a generic scanner or detector.
  • The KASLR bypass component (kaslr_prefetch.c) is referenced but its source code is not included in the provided evidence.
  • 10 text files and 1 non-text media file (assets/CVE-2026-68398.gif) were omitted from the evidence packet and not reviewed.
  • The binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED; no binary files were inspected.
  • The review is limited to static source code analysis; runtime behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

8