CVE-2026-80996

A low-impact flaw was found in the Linux kernel's L2TP (Layer 2 Tunneling Protocol) netlink handling. The netlink handlers for tunnel create, tunnel modify, session create, and session modify send a multicast notification after the requested operation has already been committed, and an error encountered while allocating, encoding, or multicasting that notification was incorrectly propagated as the result of the command. A local attacker with the privileges required to issue L2TP netlink commands could exploit this behavior so that a calling application receives a failure for an operation that actually succeeded; if the application retries the command, live L2TP tunnel and session objects accumulate in the kernel, which can lead to resource exhaustion and a denial of service. Only availability is affected; there is no impact on confidentiality or integrity. The kernel shipped in Red Hat Enterprise Linux 8 and 9, Red Hat In-Vehicle OS, and the RHEL CoreOS kernel shipped with OpenShift Container Platform 4 is affected. Red Hat Enterprise Linux 6 and 7 Extended Life Cycle Support are not affected because the vulnerable code is not present in those kernels. The fix is currently deferred for the affected products because this flaw is rated low impact and does not meet the bar for an urgent security update; the residual risk is a local denial of service by an already-privileged local user. Although the CVSS:3.1 score of 5.5 reflects the high availability impact, the low impact rating takes into account that exploitation requires local access with the privileges needed to perform L2TP netlink operations.