Kernel memory disclosure via empty PPP buffer

Use of uninitialized memory in the Linux kernel PPP subsystem allows local users to disclose kernel memory through a zero-length PPPoE send. When pppoe_sendmsg() accepts a zero-size message, it passes an empty socket buffer to ppp_async_encode(), which reads an uninitialized byte while encoding. Exploitation requires local low-privileged access and a PPP async channel; the read can expose kernel data and interrupt the host, without integrity impact.