Executive brief
The Linux kernel's L2TP (Layer 2 Tunneling Protocol) tunnel and session management commands were incorrectly propagating failures from multicast notification operations back to the user, even though the underlying tunnel or session operations had already completed successfully. This caused applications to incorrectly believe operations failed and retry, leading to accumulation of duplicate objects in the system.
Technical details
The vulnerability exists in the L2TP netlink handlers (tunnel create/modify and session create/modify) that send multicast notifications via helpers which can fail during message allocation, encoding, or transmission. The handlers were incorrectly returning the notification function's error code as the command result, even though the actual tunnel/session operation had already been committed to the kernel state. This logic error causes benign best-effort notification failures to be reported as command failures, prompting callers to retry operations that already succeeded, leading to accumulation of duplicate live objects. The fix removes the error propagation from notification calls while continuing to send notifications for listener visibility.
Affected products
- Linux Linux kernel various versions from 2.6.11 through 6.9+
Timeline
- 2026-09-11: disclosed
- 2026-08-20: patched