Executive brief
The Linux kernel's L2TP (Layer 2 Tunneling Protocol) subsystem manages tunnel and session connections used in virtual private network (VPN) infrastructure. A resource leak occurs when userspace closes the L2TP debug or proc files (/proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels) before reaching end-of-file; kernel objects holding tunnel and session references are not properly freed, causing memory exhaustion over time if an attacker repeatedly triggers this condition.
Technical details
This is a reference-counting leak (use-after-free prevention) in the L2TP subsystem's proc and debugfs file handlers. The pppol2tp_proc_open() and l2tp_dfs_seq_open() functions store tunnel and session pointers in seq_file private data for iterating across multiple read() calls. However, the corresponding release functions (pppol2tp_proc_release and l2tp_dfs_seq_release) did not decrement reference counts when the file was closed prematurely, before EOF. The fix adds explicit l2tp_session_put() and l2tp_tunnel_put() calls in the release handlers. Attack vector is local; no authentication required. An unprivileged user with read access to /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels can trigger repeated leaks leading to kernel memory exhaustion and denial of service.
Affected products
- Linux Linux kernel multiple versions prior to fix (commit 9006c116dd111d457bf5d074990210f70a4ad2c8)
Timeline
- 2026-08-26: disclosed
- 2026-08-13: patched: Fix committed upstream