---
id: 6555
title: "CVE-2026-68398 PoC: Ubuntu PPPoL2TP kernel UAF local privilege escalation"
cve: CVE-2026-68398
cvss: 7.8
severity: high
vendor: "Linux"
product: "Linux kernel PPPoL2TP"
affected_versions: "Linux kernel vulnerable lineage begins at 4.15; validated target Ubuntu 22.04.5 LTS linux-image-5.15.0-187-generic / 5.15.0-187.197; mainline fixes include 6.6.148, 6.12.101, 6.18.42, 7.1.6 and 7.2-rc4; vendor backports may differ"
source_domain: github.com
source_url: "https://github.com/aramosf/cve-2026-68398"
published_at: "2026-08-12T15:04:01Z"
tags: ["public-poc", "kernel-security", "privilege-escalation", "use-after-free", "linux-kernel", "ubuntu", "pppol2tp", "cve", "poc", "cve-2026-68398"]
phying_url: "https://phying.com/item/6555"
lang: en
---

# CVE-2026-68398 PoC: Ubuntu PPPoL2TP kernel UAF local privilege escalation

## Summary

Public PoC for CVE-2026-68398: a use-after-free race in Linux's PPPoL2TP receive path. On Ubuntu 22.04 (5.15.0-187) it takes an unprivileged user to root with KASLR, SMEP, SMAP and AppArmor enabled.

## Why it matters

The PoC turns a kernel UAF into local privilege escalation from an ordinary user to root, making it relevant for authorized Linux kernel research and patch validation. The race can panic or corrupt a system, so it should only run in an isolated, recoverable lab VM and affected kernels should be updated.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-68398
- **CVSS:** 7.8
- **Vendor:** Linux
- **Product:** Linux kernel PPPoL2TP
- **Affected versions:** Linux kernel vulnerable lineage begins at 4.15; validated target Ubuntu 22.04.5 LTS linux-image-5.15.0-187-generic / 5.15.0-187.197; mainline fixes include 6.6.148, 6.12.101, 6.18.42, 7.1.6 and 7.2-rc4; vendor backports may differ
- **Published:** 2026-08-12T15:04:01Z
- **Original:** https://github.com/aramosf/cve-2026-68398
- **Phying News:** https://phying.com/item/6555