Skip to content
CVE-2026-68398 PoC: Ubuntu PPPoL2TP kernel UAF local privilege escalation
github.com | vulnerability | High | CVE-2026-68398 | #public-poc | #kernel-security | #privilege-escalation | #use-after-free | #linux-kernel | #ubuntu | #pppol2tp | #cve | #poc | #cve-2026-68398
Summary
Public PoC for CVE-2026-68398: a use-after-free race in Linux's PPPoL2TP receive path. On Ubuntu 22.04 (5.15.0-187) it takes an unprivileged user to root with KASLR, SMEP, SMAP and AppArmor enabled.
Why it matters
The PoC turns a kernel UAF into local privilege escalation from an ordinary user to root, making it relevant for authorized Linux kernel research and patch validation. The race can panic or corrupt a system, so it should only run in an isolated, recoverable lab VM and affected kernels should be updated.
- Vendor
- Linux
- Product
- Linux kernel PPPoL2TP
- Affected versions
- Linux kernel vulnerable lineage begins at 4.15; validated target Ubuntu 22.04.5 LTS linux-image-5.15.0-187-generic / 5.15.0-187.197; mainline fixes include 6.6.148, 6.12.101, 6.18.42, 7.1.6 and 7.2-rc4; vendor backports may differ
- CVSS
- 7.8
- Published
- Collected