PT-2026-6142 · Linux · Linux Kernel

Syzbot · Published 2026-01-01 · Updated 2026-04-20 · CVE-2026-23072

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a memory leak in the l2tp udp encap recv() function. The issue was identified by syzbot, which reported a memory leak of structures like l2tp session, l2tp tunnel, and sock. The root cause was identified as a missing error handling mechanism after a change in the protocol version validation within the function. Specifically, the fix involves calling l2tp session put() to properly manage memory allocation and prevent the leak.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-23072

OPENSUSE-SU-2026:20572-1

SUSE-SU-2026:21237-1

SUSE-SU-2026:21352-1

SUSE-SU-2026:21361-1

Affected Products

Linux Kernel

References · 141

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23072.json · Exploit
• https://git.kernel.org/stable/c/4d10edfd1475b69dbd4c47f34b61a3772ece83ca · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-23072 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23072 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-23072 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-50232.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23072 · Security Note
• https://linux.oracle.com/errata/ELSA-2026-50160.html · Vendor Advisory
• https://git.kernel.org/stable/c/5cd158a88eef34e7b100cd9b963873d3b4e41b35 · Patch
• https://cve.org/CVERecord?id=CVE-2026-23072 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23072 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23072 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:21237-1 · Vendor Advisory
• https://git.kernel.org/stable/c/d4ce79e6dce2a4a49eebceea7b4caf5dc0f0ef3d · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:20572-1 · Vendor Advisory