CVE-2026-63918
Received Received - Intake

Use-After-Free in Linux Kernel L2TP

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname A reader in l2tp_session_get_by_ifname() can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plain refcount_inc(), but every other session getter in the same file (l2tp_v2_session_get, l2tp_v3_session_get, and the corresponding _get_next variants) uses refcount_inc_not_zero() because the IDR/RCU lookup can race with refcount_dec_and_test() -> l2tp_session_free() -> kfree_rcu(). The ifname getter is the only outlier; the inconsistency was raised on-list after 979c017803c4 ("l2tp: use list_del_rcu in l2tp_session_unhash"). A reader inside rcu_read_lock_bh() that matches session->ifname can be preempted between the strcmp() and the refcount_inc(). If the last reference drops on another CPU in that window, the reader's refcount_inc() runs on a counter that has reached zero. refcount_t catches the addition-on-zero, prints "refcount_t: addition on 0; use-after-free", saturates the counter, and returns the saturated pointer to the caller. Session memory is held live by the in-flight RCU read section, but the kfree_rcu() callback queued from l2tp_session_free() will free it once the grace period closes; a caller that dereferences the returned session past that point hits a slab-use-after-free. On PREEMPT_RT local_bh_disable() is a per-CPU sleeping lock and the preemption window is real; on stock PREEMPT kernels local_bh_disable() is a preempt_count increment that closes the cross-CPU race in practice (see below). Use refcount_inc_not_zero() and continue the list walk on failure, matching the other session getters in the file. The ifname getter is the only session getter in net/l2tp/ that still uses the bare refcount_inc() pattern; this change restores file-internal consistency. The success path is unchanged.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63918
EUVD
EUVD-2026-45691

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the l2tp_session_get_by_ifname function. The function incorrectly uses refcount_inc() instead of refcount_inc_not_zero() like other session getters, allowing a use-after-free scenario. A reader thread can return a session pointer with a refcount of zero, leading to a saturated counter and potential slab-use-after-free when the memory is freed by an RCU callback.

Detection Guidance

This vulnerability is specific to the Linux kernel's L2TP implementation and involves a race condition in session reference counting. Detection requires checking the kernel version and L2TP module behavior. Use 'uname -a' to check kernel version and 'lsmod | grep l2tp' to verify L2TP module loading. Monitor kernel logs for 'refcount_t: addition on 0; use-after-free' messages which indicate exploitation attempts.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial-of-service by triggering a use-after-free condition. This might lead to system crashes, memory corruption, or arbitrary code execution with kernel privileges. Systems using vulnerable Linux kernel versions with L2TP functionality enabled are at risk.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's L2TP session handling. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy controls rather than kernel memory management issues.

Mitigation Strategies

Apply the latest kernel security patches immediately. Update to a kernel version containing the fix for this issue. If immediate patching isn't possible, consider disabling the L2TP module with 'modprobe -r l2tp_netlink l2tp_ppp' until patched. Monitor vendor advisories for kernel updates addressing this specific issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63918. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart