Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-25T00:00:00 kernel: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-911

In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol2tp_ioctl() read sock->sk->sk_user_data directly without any locks or reference counting. If a controllable sleep was induced during copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger pppol2tp_session_close() asynchronously. This frees the l2tp_session structure via the l2tp_session_del_work workqueue. Upon resuming, the ioctl thread dereferences the stale session pointer, resulting in a Use-After-Free (UAF). Fix this by securely fetching the session reference using the RCU-safe, refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the session's refcount across the sleep. We structured the function to exit via standard err breaks, guaranteeing that l2tp_session_put() is cleanly called on all return paths to drop the reference. To preserve existing behavior we validate the session and its magic signature only for the specific L2TP commands that require it. This ensures that generic/unknown ioctls called on an unconnected socket still return -ENOIOCTLCMD and correctly fall back to generic handlers (e.g. in sock_do_ioctl()).

A flaw was found in the Linux kernel's `pppol2tp` module. This Use-After-Free (UAF) vulnerability arises from improper handling of session references within the `pppol2tp_ioctl()` function. A local attacker could exploit this by triggering a race condition during data copying, leading to the dereferencing of a stale session pointer. This could result in a system crash, causing a Denial of Service (DoS), or potentially allow for arbitrary code execution.

Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Affected kernel Red Hat Enterprise Linux 7 Affected kernel Red Hat Enterprise Linux 7 Affected kernel-rt Red Hat Enterprise Linux 8 Affected kernel Red Hat Enterprise Linux 8 Affected kernel-rt Red Hat Enterprise Linux 9 Affected kernel Red Hat Enterprise Linux 9 Affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-53262 https://nvd.nist.gov/vuln/detail/CVE-2026-53262 https://lore.kernel.org/linux-cve-announce/2026062516-CVE-2026-53262-3892@gregkh/T