PT-2026-61436 · Linux · Linux
CVE-2026-64119
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
l2tp: use list del rcu in l2tp session unhash
An unprivileged local user can pin a host CPU indefinitely in
l2tp session get by ifname() by issuing L2TP CMD SESSION GET on
L2TP ATTR IFNAME concurrently with L2TP CMD SESSION CREATE and
L2TP CMD SESSION DELETE on the same tunnel. All three commands take
GENL UNS ADMIN PERM, so CAP NET ADMIN in the netns user namespace
suffices; on any host that has l2tp core loaded the trigger is
reachable from a standard
unshare -Urn sandbox.l2tp session unhash() removes a session from tunnel->session list
with list del init(), but that list is walked by
l2tp session get by ifname() with list for each entry rcu() under
rcu read lock bh(). list del init() leaves the deleted entry's
next/prev self-pointing; a reader that has loaded the entry and
then advances pos->list.next reads &session->list, container of()s
back to the same session, and list for each entry rcu() never
reaches the list head. The CPU stays in strcmp() inside the
walker, with BH and preemption disabled, so RCU grace periods on
the host stall behind it and the wedged thread cannot be killed
(SIGKILL is delivered on syscall return).
Use list del rcu() to match the existing list add rcu() in
l2tp session register(); the deleted session remains visible to
in-flight walkers with consistent next/prev pointers until
kfree rcu() in l2tp session free() releases it. tunnel->session list
has exactly one list del init() call site; the list del init
(&session->clist) at l2tp core.c:533 operates on the per-collision
list, which is not walked under RCU. list empty(&session->list) is
not used anywhere in net/l2tp/ after the unhash point, so dropping
the post-delete self-init is safe; the fix has no userspace-visible
behavior change.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux