PT-2026-61235 · Linux · Linux

CVE-2026-63918 · Published 2026-07-19 · Updated 2026-07-19

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

l2tp: use refcount inc not zero in l2tp session get by ifname

A reader in l2tp session get by ifname() can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plain refcount inc(), but every other session getter in the same file (l2tp v2 session get, l2tp v3 session get, and the corresponding get next variants) uses refcount inc not zero() because the IDR/RCU lookup can race with refcount dec and test() -> l2tp session free() -> kfree rcu(). The ifname getter is the only outlier; the inconsistency was raised on-list after 979c017803c4 ("l2tp: use list del rcu in l2tp session unhash").

A reader inside rcu read lock bh() that matches session->ifname can be preempted between the strcmp() and the refcount inc(). If the last reference drops on another CPU in that window, the reader's refcount inc() runs on a counter that has reached zero. refcount t catches the addition-on-zero, prints "refcount t: addition on 0; use-after-free", saturates the counter, and returns the saturated pointer to the caller. Session memory is held live by the in-flight RCU read section, but the kfree rcu() callback queued from l2tp session free() will free it once the grace period closes; a caller that dereferences the returned session past that point hits a slab-use-after-free. On PREEMPT RT local bh disable() is a per-CPU sleeping lock and the preemption window is real; on stock PREEMPT kernels local bh disable() is a preempt count increment that closes the cross-CPU race in practice (see below).

Use refcount inc not zero() and continue the list walk on failure, matching the other session getters in the file. The ifname getter is the only session getter in net/l2tp/ that still uses the bare refcount inc() pattern; this change restores file-internal consistency. The success path is unchanged.

Fix

Related Identifiers

CVE-2026-63918

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-63918 · Security Note
• https://git.kernel.org/stable/c/782d60a6596aee9b29c2eecfa70033899278bf65 · Note
• https://git.kernel.org/stable/c/947013fd7c8c35dd5856557b215840098a3f67f8 · Note
• https://git.kernel.org/stable/c/ee80455feffb9cb62b5b58715cabeff495e666b2 · Note
• https://git.kernel.org/stable/c/05f95729ca844704d15e49ce14868af4b403b32b · Note