Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after dev_hard_header() pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This can happen when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head. Reload the PPPoE header through the skb's network-header offset after device header creation. pskb_expand_head() updates that offset when it relocates the head.
A public local privilege escalation PoC for CVE-2026-68121 (PPPoEject) has been published. PoC: https://github.com/manizada/PPPoEject oss-security disclosure: https://seclists.org/oss-sec/2026/q3/822 Upstream fix: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e9c238f6fe42fb1b4dba3a578277de32cb487937 The published PoC demonstrates local user-to-root privilege escalation. Please review the impact on supported RHEL kernels based on the public PoC and upstream fix.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:71330 https://access.redhat.com/errata/RHSA-2026:71330
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:71329 https://access.redhat.com/errata/RHSA-2026:71329
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:71565 https://access.redhat.com/errata/RHSA-2026:71565
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:71592 https://access.redhat.com/errata/RHSA-2026:71592
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:71594 https://access.redhat.com/errata/RHSA-2026:71594
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:71606 https://access.redhat.com/errata/RHSA-2026:71606
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:71569 https://access.redhat.com/errata/RHSA-2026:71569
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:71601 https://access.redhat.com/errata/RHSA-2026:71601
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:71599 https://access.redhat.com/errata/RHSA-2026:71599
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:71602 https://access.redhat.com/errata/RHSA-2026:71602
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION Via RHSA-2026:71649 https://access.redhat.com/errata/RHSA-2026:71649
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:71657 https://access.redhat.com/errata/RHSA-2026:71657
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:71631 https://access.redhat.com/errata/RHSA-2026:71631
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:71687 https://access.redhat.com/errata/RHSA-2026:71687
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:71700 https://access.redhat.com/errata/RHSA-2026:71700
This issue has been addressed in the following products: NVIDIA for RHEL 10 Via RHSA-2026:73788 https://access.redhat.com/errata/RHSA-2026:73788