Linux Kernel EUVD-2026-55502

The vulnerability resides in the PPPoE (Point-to-Point Protocol over Ethernet) subsystem of the Linux kernel, specifically in pppoe_sendmsg(). Socket buffers (skbs) in the Linux networking stack have a head region that can be reallocated by device header callbacks via pskb_expand_head(). The PPPoE driver incorrectly holds a direct pointer into this head across a call to dev_hard_header(), which for team devices with delegated GRE header callbacks performs exactly such a reallocation. The race condition materializes when a PPPoE send is blocked in copy_from_user() - a sleepable operation - while another thread concurrently adds the first non-Ethernet port to an empty team device, causing the GRE callback to expand the skb head. The PPPoE code then writes six bytes through the stale pointer into the former buffer location. The fix reloads the PPPoE header pointer via skb_network_header() after dev_hard_header() returns, since pskb_expand_head() correctly updates the skb's network-header offset upon relocation. While no CWE is formally assigned, the pattern matches CWE-825 (Expired Pointer Dereference) combined with a concurrent-access race, analogous to CWE-362. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.