Executive brief
A vulnerability was identified in the Linux kernel's L2TP networking component, which is used for virtual private networks (VPNs). A local attacker could exploit a race condition during certain system calls to cause a system crash or instability. This issue affects the reliability of systems using L2TP for network tunneling.
Technical details
A use-after-free (UAF) vulnerability exists in net/l2tp/l2tp_ppp.c within the pppol2tp_ioctl() function. The function originally accessed session data without proper reference counting or locking. An attacker can trigger a controllable sleep during copy_from_user() (for example, using userfaultfd) while concurrently closing the socket. This causes the l2tp_session structure to be freed by the workqueue while the ioctl thread is still active. When the ioctl thread resumes, it dereferences the stale pointer. The fix introduces RCU-safe reference counting using pppol2tp_sock_to_session() to ensure the session remains valid throughout the ioctl execution.
Affected products
- Linux Linux Kernel 2.6.35 to 6.12.94, 6.18.36, 7.0.13
Timeline
- 2026-05-27: other: Patch submitted by Lee Jones
- 2026-06-25: disclosed: CVE published