l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol2tp_ioctl() read sock->sk->sk_user_data directly without any locks or reference counting. If a controllable sleep was induced during copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger pppol2tp_session_close() asynchronously. This frees the l2tp_session structure via the l2tp_session_del_work workqueue. Upon resuming, the ioctl thread dereferences the stale session pointer, resulting in a Use-After-Free (UAF). Fix this by securely fetching the session reference using the RCU-safe, refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the session's refcount across the sleep. We structured the function to exit via standard err breaks, guaranteeing that l2tp_session_put() is cleanly called on all return paths to drop the reference. To preserve existing behavior we validate the session and its magic signature only for the specific L2TP commands that require it. This ensures that generic/unknown ioctls called on an unconnected socket still return -ENOIOCTLCMD and correctly fall back to generic handlers (e.g. in sock_do_ioctl()).
CVE-2026-53262
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-53262
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "fd558d186df2c13a22455373858bae634a4795af",
"lessThan": "312ecea13b67797747eb9d4b9dab8d3846de6dfb",
"versionType": "git"
},
{
"status": "affected",
"version": "fd558d186df2c13a22455373858bae634a4795af",
"lessThan": "78cdfdca88cbf731a92f3b9ee5427c633dd94e28",
"versionType": "git"
},
{
"status": "affected",
"version": "fd558d186df2c13a22455373858bae634a4795af",
"lessThan": "e251d4cdfc725c9e7d686161e3b775a0e7d95053",
"versionType": "git"
},
{
"status": "affected",
"version": "fd558d186df2c13a22455373858bae634a4795af",
"lessThan": "62f327e287cf7b595ae3f73ba72f5cd2a9e9f39f",
"versionType": "git"
},
{
"status": "affected",
"version": "fd558d186df2c13a22455373858bae634a4795af",
"lessThan": "a213a8950414c684999dcf03edeea6c46ede172e",
"versionType": "git"
}
],
"programFiles": [
"net/l2tp/l2tp_ppp.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.35",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/l2tp/l2tp_ppp.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-53262
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #46382 · Revision 1
- Added to Heist Feed
- Publisher date