PT-2024-33782 · Linux+5 · Linux Kernel+5

Published

2024-07-29

·

Updated

2026-05-26

·

CVE-2024-49940

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)
Description: The issue is related to a possible tunnel refcount underflow in the Linux kernel's l2tp module. When a session is created, it sets a backpointer to its tunnel, and when the session refcount drops to 0, the tunnel refcount is dropped if session->tunnel is non-NULL. However, there is a small window where session->tunnel is non-NULL when the tunnel refcount hasn't been incremented. To fix this, an encap argument is added to l2tp session set header len to avoid using session->tunnel. Additionally, a check is added to handle the case where l2tpv3 sessions have colliding IDs and l2tp v3 session get races with l2tp session register.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

Related Identifiers

ALSA-2025_12746
ALSA-2025_12752
ALSA-2025_12753
ALSA-2025_16880
ALT-PU-2024-17211
ALT-PU-2025-12647
AZL-52917
AZL-52947
BDU:2025-16126
CVE-2024-49940
ECHO-F332-23D3-C09D
OESA-2024-2367
OESA-2024-2368
OESA-2024-2369
OESA-2024-2371
OPENSUSE-SU-2024:14500-1
OPENSUSE-SU-2025:14705-1
OPENSUSE-SU-2025_1177-1
OPENSUSE-SU-2025_1178-1
OPENSUSE-SU-2025_1180-1
SUSE-SU-2025:01919-1
SUSE-SU-2025:1177-1
SUSE-SU-2025:1178-1
SUSE-SU-2025:1180-1
SUSE-SU-2025:1293-1
SUSE-SU-2025:20190-1
SUSE-SU-2025:20192-1
SUSE-SU-2025:20260-1
SUSE-SU-2025:20270-1
SUSE-SU-2025_1177-1
SUSE-SU-2025_1178-1
SUSE-SU-2025_1180-1
SUSE-SU-2025_1293-1
USN-7276-1
USN-7277-1
USN-7310-1

Affected Products

Alt Linux
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu