A use-after-free vulnerability in the Linux kernel PPPoE driver allows a local attacker to escalate privileges and compromise system integrity.

The vulnerability exists in the pppoe_sendmsg function, where the PPPoE header pointer is not properly reloaded after a device header callback; this allows an authenticated local attacker to trigger a use-after-free condition.

With a CVSS score of 7.8, this vulnerability represents a high-severity risk. Successful exploitation allows a local attacker to execute arbitrary code with elevated privileges, leading to a complete compromise of system confidentiality, integrity, and availability.

Immediate Action: Update the Linux kernel to version 5.10.265, 5.15.216, 6.1.183, 6.6.148, or later.

Proactive Monitoring: Audit system logs for unexpected crashes or error messages related to PPPoE or network device reconfiguration.

Compensating Controls: Restrict access to the system to only trusted users and minimize the use of PPPoE on untrusted networks until patches are applied.

Public Exploit Available: No (unknown).

System administrators must apply the provided kernel updates immediately to mitigate the risk of local privilege escalation. Ensuring that all kernel components are updated to the specified versions is the only reliable method to resolve this memory management flaw.