CVE-2026-64119
Received Received - Intake

Linux Kernel RCU CPU Pinning in L2TP Session Handling

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: l2tp: use list_del_rcu in l2tp_session_unhash An unprivileged local user can pin a host CPU indefinitely in l2tp_session_get_by_ifname() by issuing L2TP_CMD_SESSION_GET on L2TP_ATTR_IFNAME concurrently with L2TP_CMD_SESSION_CREATE and L2TP_CMD_SESSION_DELETE on the same tunnel. All three commands take GENL_UNS_ADMIN_PERM, so CAP_NET_ADMIN in the netns user namespace suffices; on any host that has l2tp_core loaded the trigger is reachable from a standard `unshare -Urn` sandbox. l2tp_session_unhash() removes a session from tunnel->session_list with list_del_init(), but that list is walked by l2tp_session_get_by_ifname() with list_for_each_entry_rcu() under rcu_read_lock_bh(). list_del_init() leaves the deleted entry's next/prev self-pointing; a reader that has loaded the entry and then advances pos->list.next reads &session->list, container_of()s back to the same session, and list_for_each_entry_rcu() never reaches the list head. The CPU stays in strcmp() inside the walker, with BH and preemption disabled, so RCU grace periods on the host stall behind it and the wedged thread cannot be killed (SIGKILL is delivered on syscall return). Use list_del_rcu() to match the existing list_add_rcu() in l2tp_session_register(); the deleted session remains visible to in-flight walkers with consistent next/prev pointers until kfree_rcu() in l2tp_session_free() releases it. tunnel->session_list has exactly one list_del_init() call site; the list_del_init (&session->clist) at l2tp_core.c:533 operates on the per-collision list, which is not walked under RCU. list_empty(&session->list) is not used anywhere in net/l2tp/ after the unhash point, so dropping the post-delete self-init is safe; the fix has no userspace-visible behavior change.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64119
EUVD
EUVD-2026-45804

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where an unprivileged local user can cause a CPU to hang indefinitely. The issue occurs in the L2TP (Layer 2 Tunneling Protocol) subsystem when using specific commands concurrently. The root cause is improper list deletion in l2tp_session_unhash() which leaves the session list in an inconsistent state, causing RCU readers to loop infinitely.

Detection Guidance

This vulnerability is specific to the Linux kernel's L2TP implementation and requires kernel-level access to trigger. Detection involves checking if your kernel version includes the vulnerable code path. Use uname -a to check your kernel version and compare it against patched versions. No direct network commands can detect this as it requires local kernel exploitation.

Impact Analysis

An attacker with CAP_NET_ADMIN privileges in a user namespace (achievable via unshare -Urn) can trigger this flaw to freeze a CPU core. This leads to system unresponsiveness, prevents proper task scheduling, and makes the affected thread unkillable. The attack requires local access but no special privileges beyond basic namespace capabilities.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a local denial-of-service issue in the Linux kernel's L2TP implementation. It does not involve data breaches, unauthorized access, or data processing violations that these regulations typically address.

Mitigation Strategies

Apply the latest kernel security updates from your Linux distribution. If no patch is available, consider disabling the L2TP module by blacklisting l2tp_netlink and l2tp_core. Restrict CAP_NET_ADMIN capabilities in user namespaces to prevent unprivileged local exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64119. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart