ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More · 2h Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks · 5h NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks · 8h Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing · 8h Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules · 9h Vulnerability in Sparx Systems Enterprise Architect software · 9h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 9h Vulnerabilities in Slican telephone exchanges · 10h Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls · 13h Cisco meldt actief misbruik van kritiek lek in Secure Email Gateway · 14h ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More · 2h Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks · 5h NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks · 8h Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing · 8h Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules · 9h Vulnerability in Sparx Systems Enterprise Architect software · 9h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 9h Vulnerabilities in Slican telephone exchanges · 10h Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls · 13h Cisco meldt actief misbruik van kritiek lek in Secure Email Gateway · 14h

ACyber Sentinel Security Assessment Team

← Back to feed

⚠️ Vulnerability Report

CVE-2026-68121

HIGH CVSS 7.8 CVSS 3.1 📌 Received

CVE-2026-68121 - pppoe: reload header pointer after dev_hard_header()

In the Linux kernel, the following vulnerability has been resolved:

pppoe: reload header pointer after dev_hard_header()

pppoe_sendmsg() saves a pointer to the PPPoE header before calling

dev_hard_header(). Device header callbacks are allowed to reallocate the

skb head, invalidating pointers into it.

This can happen when a send is blocked in copy_from_user() while the first

non-Ethernet port is added to an empty team device. The team's delegated

GRE header callback then expands the skb head. PPPoE subsequently writes

six bytes through the stale pointer into the freed head.

Reload the PPPoE header through the skb's network-header offset after

device header creation. pskb_expand_head() updates that offset when it

relocates the head.

Published: Aug 10, 2026 13:19

Last Modified: Aug 19, 2026 17:20