In the Linux kernel, the following vulnerability has been resolved:
l2tp: prevent possible tunnel refcount underflow
When a session is created, it sets a backpointer to its tunnel. When the session refcount drops to 0, l2tp_session_free drops the tunnel refcount if session->tunnel is non-NULL. However, session->tunnel is set in l2tp_session_create, before the tunnel refcount is incremented by l2tp_session_register, which leaves a small window where session->tunnel is non-NULL when the tunnel refcount hasn't been bumped.
Moving the assignment to l2tp_session_register is trivial but l2tp_session_create calls l2tp_session_set_header_len which uses session->tunnel to get the tunnel's encap. Add an encap arg to l2tp_session_set_header_len to avoid using session->tunnel.
If l2tpv3 sessions have colliding IDs, it is possible for l2tp_v3_session_get to race with l2tp_session_register and fetch a session which doesn't yet have session->tunnel set. Add a check for this case.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution existsUpgrade linux | May 15, 2025 | Oct 21, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perfUpgrade kernel-tools | Feb 11, 2025 | Oct 21, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools | Feb 11, 2025 | Oct 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 21, 2024 |
| Ubuntu | — | Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-24.04bUpgrade linux-image-oracleUpgrade linux-image-genericUpgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-6.11.0-18-genericUpgrade linux-image-virtualUpgrade linux-image-generic-64kUpgrade linux-image-6.11.0-1015-oemUpgrade linux-image-oracle-64kUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-realtimeUpgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-oem-24.04aUpgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-24.04Upgrade linux-image-azureUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-awsUpgrade linux-image-6.11.0-1009-azureUpgrade linux-image-azure-fdeUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-generic-64k-hwe-24.04 | Feb 20, 2025 | Oct 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub