PT-2026-52357 · Linux · Linux

Publicado

2026-06-25

·

Atualizado

2026-06-25

·

CVE-2026-53262

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
l2tp: pppol2tp: hold reference to session in pppol2tp ioctl()
pppol2tp ioctl() read sock->sk->sk user data directly without any locks or reference counting. If a controllable sleep was induced during copy from user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger pppol2tp session close() asynchronously. This frees the l2tp session structure via the l2tp session del work workqueue. Upon resuming, the ioctl thread dereferences the stale session pointer, resulting in a Use-After-Free (UAF).
Fix this by securely fetching the session reference using the RCU-safe, refcounted helper pppol2tp sock to session(sk) on entry. This locks the session's refcount across the sleep. We structured the function to exit via standard err breaks, guaranteeing that l2tp session put() is cleanly called on all return paths to drop the reference.
To preserve existing behavior we validate the session and its magic signature only for the specific L2TP commands that require it. This ensures that generic/unknown ioctls called on an unconnected socket still return -ENOIOCTLCMD and correctly fall back to generic handlers (e.g. in sock do ioctl()).
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-53262

Produtos afetados

Linux