In the Linux kernel, the following vulnerability has been resolved:
pppoe: reload header pointer after dev_hard_header()
pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it.
This can happen when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head.
Reload the PPPoE header through the skb's network-header offset after device header creation. pskb_expand_head() updates that offset when it relocates the head.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade bpftool6.18Upgrade kernel6.12Upgrade bpftool6.18-debuginfoUpgrade kernel6.18-modules-extra-commonUpgrade kernel-livepatch-6.12.103-127.188Upgrade kernel6.12-headersUpgrade kernel6.18-debuginfo-common-aarch64Upgrade bpftool6.12-debuginfoUpgrade perf6.12Upgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-develUpgrade bpftool6.12Upgrade kernel6.12-toolsUpgrade kernel6.12-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.18-toolsUpgrade kernel6.18-headersUpgrade kernel-livepatch-6.18.44-99.149Upgrade perf6.12-debuginfoUpgrade kernel6.18-modules-extraUpgrade kernel6.18-debuginfoUpgrade kernel6.12-modules-extra-commonUpgrade python3-perf6.12-debuginfoUpgrade python3-perf6.18Upgrade microvm-kernel6.18Upgrade kernel6.12-modules-extraUpgrade kernel6.18Upgrade kernel6.12-debuginfoUpgrade perf6.18-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade python3-perf6.18-debuginfoUpgrade kernel6.18-tools-develUpgrade kernel6.18-tools-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade python3-perf6.12Upgrade perf6.18Upgrade kernel6.12-tools-devel | Sep 1, 2026 | Aug 10, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Aug 11, 2026 | Aug 11, 2026 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Aug 13, 2026 | Aug 10, 2026 |
| Rocky_linux | — | Upgrade kernel-debug-modules-extraUpgrade python3-perfUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-coreUpgrade kernel-modules-coreUpgrade libperf-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rtUpgrade perf-debuginfoUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-tools-libs-develUpgrade kernel-devel-matchedUpgrade perfUpgrade kernel-rt-modules-coreUpgrade kernel-modulesUpgrade libperfUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-uki-virtUpgrade kernel-debuginfo-common-s390xUpgrade kernel-develUpgrade kernelUpgrade kernel-zfcpdumpUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-modulesUpgrade kernel-coreUpgrade kernel-toolsUpgrade kernel-debugUpgrade kernel-rt-develUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-develUpgrade kernel-debug-debuginfoUpgrade kernel-rt-coreUpgrade kernel-debug-modulesUpgrade rvUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debugUpgrade kernel-tools-debuginfoUpgrade kernel-debug-uki-virtUpgrade rtlaUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-modules-coreUpgrade bpftool-debuginfoUpgrade kernel-modules-extra-matchedUpgrade kernel-debug-coreUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel-tools-libs | Sep 28, 2026 | Sep 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 17, 2026 | Aug 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub