CVE-2026-23120
Description
A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP) implementation. A local user can exploit a data-race condition during L2TP tunnel deletion. This occurs when the l2tp_tunnel_del_work function attempts to read socket information without proper synchronization while the underlying socket is concurrently closed. Successfully exploiting this timing window can lead to a kernel crash or system hang, resulting in a Denial of Service (DoS).
Statement
A race exists in the L2TP tunnel deletion workqueue path where l2tp_tunnel_del_work read sk->sk_socket without synchronization while another task could concurrently orphan and close the underlying socket. KCSAN reports a data race where sk_socket changes from a valid pointer to NULL during the work execution. This is primarily a stability issue that can lead to incorrect behavior and potentially a kernel crash or hang depending on timing and follow on code paths. For the CVSS the PR is L because a local user can create and close sockets and can trigger L2TP teardown operations through normal interfaces. The attack complexity is high because it requires winning a narrow timing window between socket close and the deferred tunnel deletion work. Impact is mainly availability due to potential kernel crash.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.8 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | High | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | Low | None | N/A |
| Integrity Impact | Low | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Alter Execution Logic; Unexpected State
The main problem is that -- if a lock is overcome -- data could be altered in a bad state.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
