CVE-2026-74735
Received Received - Intake

Reference Leak in Linux Kernel L2TP Implementation

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: l2tp: fix tunnel and session refcount leak on seq_file release In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state (pd->tunnel and pd->session) is kept in seq_file private data to allow iteration across multiple read() system calls. However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reading to end-of-file (EOF), any tunnel or session reference stored in pd->tunnel / pd->session is left un-dropped when seq_file private data is freed. Fix this by dropping any remaining pd->tunnel and pd->session references in pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-74735
EUVD
EUVD-2026-66565

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel l2tp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a reference count leak in the L2TP (Layer Two Tunneling Protocol) module. When certain /proc or /sys files are opened but not fully read to EOF before being closed, tunnel or session references are not properly released. This can lead to resource leaks where system resources are not freed even after they are no longer needed.

Detection Guidance

This vulnerability is specific to the Linux kernel's L2TP implementation and may not have direct detection commands. Monitor for unexpected tunnel or session reference leaks in /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels. Check kernel logs for errors related to L2TP or seq_file operations.

Impact Analysis

The impact includes potential resource exhaustion on the system. If exploited repeatedly, this could lead to denial-of-service conditions where the system runs out of available resources due to un-released references. It primarily affects systems using L2TP tunneling.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Ensure all L2TP-related services are restarted after the update to apply the changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74735. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart