CVE-2026-53262
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile — higher than 3% of all known CVEs
Summary
A Use-After-Free (UAF) vulnerability was found in the Linux kernel's L2TP driver (pppol2tp) in the pppol2tp_ioctl() function. The function read the session pointer without locks or reference counting, allowing a race condition during copy_from_user().
Risk Assessment
An attacker could exploit this vulnerability to achieve remote code execution in the kernel or privilege escalation, leading to full system compromise.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit using RCU-safe helper pppol2tp_sock_to_session).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol2tp_ioctl() read sock->sk->sk_user_data directly without any locks or reference counting. If a controllable sleep was induced during copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger pppol2tp_session_close() asynchronously. This frees the l2tp_session structure via the l2tp_session_del_work workqueue. Upon resuming, the ioctl thread dereferences the stale session pointer, resulting in a Use-After-Free (UAF). Fix this by securely fetching the session reference using the RCU-safe, refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the session's refcount across the sleep. We structured the function to exit via standard err breaks, guaranteeing that l2tp_session_put() is cleanly called on all return paths to drop the reference. To preserve existing behavior we validate the session and its magic signature only for the specific L2TP commands that require it. This ensures that generic/unknown ioctls called on an unconnected socket still return -ENOIOCTLCMD and correctly fall back to generic handlers (e.g. in sock_do_ioctl()).