PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-68398 PoC: Ubuntu PPPoL2TP kernel UAF local privilege escalation

github.com | vulnerability | High | CVE-2026-68398 | #public-poc | #kernel-security | #privilege-escalation | #use-after-free | #linux-kernel | #ubuntu | #pppol2tp | #cve | #poc | #cve-2026-68398
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Public PoC for CVE-2026-68398: a use-after-free race in Linux's PPPoL2TP receive path. On Ubuntu 22.04 (5.15.0-187) it takes an unprivileged user to root with KASLR, SMEP, SMAP and AppArmor enabled.

Why it matters

The PoC turns a kernel UAF into local privilege escalation from an ordinary user to root, making it relevant for authorized Linux kernel research and patch validation. The race can panic or corrupt a system, so it should only run in an isolated, recoverable lab VM and affected kernels should be updated.
CVE
CVE-2026-68398
Vendor
Linux
Product
Linux kernel PPPoL2TP
Affected versions
Linux kernel vulnerable lineage begins at 4.15; validated target Ubuntu 22.04.5 LTS linux-image-5.15.0-187-generic / 5.15.0-187.197; mainline fixes include 6.6.148, 6.12.101, 6.18.42, 7.1.6 and 7.2-rc4; vendor backports may differ
CVSS
7.8
Published
Collected

Related coverage

High · vulnerability · nebusec.ai
IonStack part III: Rooting Android 17 with GhostLock
GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebula Security that exists in every major distribution since 2011. After turning it into a stable privilege escalation and container escape, we took one step further and used GhostLock to develop the world's first public Android 17 root. This writeup covers the additional exploit techniques used to migrate the exploit for Android.
tool · github.com
CVE-2026-68138 PoC: Linux qdisc rate-table race local privilege escalation
The public PoC turns the kernel race into a reproducible local root-escalation chain. It requires specific kernel configuration and an isolated lab, but hosts exposing the relevant namespace, traffic-control, and module-loading capabilities should verify that the upstream fix or an equivalent backport is present.
High · vulnerability · nebusec.ai
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
A 15-year-old Linux kernel stack use-after-free was turned into reliable local privilege escalation and container escape, affecting essentially every unpatched major distribution.
blog · guysrd.github.io
I handed the epoll UAF to an agent
The author handed the epoll UAF (CVE-2026-46242) to Claude, which ported the exploit to a Pixel 10 and reached a root shell in the vold SELinux domain, fully agent-driven at roughly 30% reliability.
High · vulnerability · github.com
CVE-2026-42980 PoC: Windows kernel WMI integer underflow local privilege escalation
The public code turns a Windows kernel integer underflow into local escalation from a normal user to SYSTEM, making it relevant to authorized kernel research and patch validation. Reproduction should be limited to owned, isolated, recoverable systems, and Microsoft fixes should be applied promptly.
vulnerability · theori.io
Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)
A deep dive into CVE-2024-27394, a TCP-AO use-after-free caused by incorrect RCU API usage in the Linux kernel, covering RCU internals, the patch, and the ExpRace technique for reliable triggering.
Back