PT-2026-61436 · Linux · Linux

CVE-2026-64119

·

Publicado

2026-07-19

·

Atualizado

2026-07-19

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
l2tp: use list del rcu in l2tp session unhash
An unprivileged local user can pin a host CPU indefinitely in l2tp session get by ifname() by issuing L2TP CMD SESSION GET on L2TP ATTR IFNAME concurrently with L2TP CMD SESSION CREATE and L2TP CMD SESSION DELETE on the same tunnel. All three commands take GENL UNS ADMIN PERM, so CAP NET ADMIN in the netns user namespace suffices; on any host that has l2tp core loaded the trigger is reachable from a standard unshare -Urn sandbox.
l2tp session unhash() removes a session from tunnel->session list with list del init(), but that list is walked by l2tp session get by ifname() with list for each entry rcu() under rcu read lock bh(). list del init() leaves the deleted entry's next/prev self-pointing; a reader that has loaded the entry and then advances pos->list.next reads &session->list, container of()s back to the same session, and list for each entry rcu() never reaches the list head. The CPU stays in strcmp() inside the walker, with BH and preemption disabled, so RCU grace periods on the host stall behind it and the wedged thread cannot be killed (SIGKILL is delivered on syscall return).
Use list del rcu() to match the existing list add rcu() in l2tp session register(); the deleted session remains visible to in-flight walkers with consistent next/prev pointers until kfree rcu() in l2tp session free() releases it. tunnel->session list has exactly one list del init() call site; the list del init (&session->clist) at l2tp core.c:533 operates on the per-collision list, which is not walked under RCU. list empty(&session->list) is not used anywhere in net/l2tp/ after the unhash point, so dropping the post-delete self-init is safe; the fix has no userspace-visible behavior change.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64119

Produtos afetados

Linux