CVE-2026-64119 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
l2tp: use list_del_rcu in l2tp_session_unhash
An unprivileged local user can pin a host CPU indefinitely in l2tp_session_get_by_ifname() by issuing L2TP_CMD_SESSION_GET on L2TP_ATTR_IFNAME concurrently with L2TP_CMD_SESSION_CREATE and L2TP_CMD_SESSION_DELETE on the same tunnel. All three commands take GENL_UNS_ADMIN_PERM, so CAP_NET_ADMIN in the netns user namespace suffices; on any host that has l2tp_core loaded the trigger is reachable from a standard `unshare -Urn` sandbox.
l2tp_session_unhash() removes a session from tunnel->session_list with list_del_init(), but that list is walked by l2tp_session_get_by_ifname() with list_for_each_entry_rcu() under rcu_read_lock_bh(). list_del_init() leaves the deleted entry's next/prev self-pointing; a reader that has loaded the entry and then advances pos->list.next reads &session->list, container_of()s back to the same session, and list_for_each_entry_rcu() never reaches the list head. The CPU stays in strcmp() inside the walker, with BH and preemption disabled, so RCU grace periods on the host stall behind it and the wedged thread cannot be killed (SIGKILL is delivered on syscall return).
Use list_del_rcu() to match the existing list_add_rcu() in l2tp_session_register(); the deleted session remains visible to in-flight walkers with consistent next/prev pointers until kfree_rcu() in l2tp_session_free() releases it. tunnel->session_list has exactly one list_del_init() call site; the list_del_init (&session->clist) at l2tp_core.c:533 operates on the per-collision list, which is not walked under RCU. list_empty(&session->list) is not used anywhere in net/l2tp/ after the unhash point, so dropping the post-delete self-init is safe; the fix has no userspace-visible behavior change.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability resides within the linux kernel's l2tp implementation where a race condition exists between session management operations that can lead to indefinite cpu pinning and system instability. This flaw specifically affects the l2tp_session_unhash() function which removes sessions from the tunnel session list using list_del_init() instead of the appropriate list_del_rcu() operation. The issue stems from inconsistent use of synchronization primitives where the session list is accessed under rcu_read_lock_bh() by l2tp_session_get_by_ifname() but modified with a non-rcu aware deletion method.
The technical execution involves an unprivileged local user leveraging capabilities within a network namespace to trigger a specific race condition. By concurrently issuing L2TP_CMD_SESSION_GET on L2TP_ATTR_IFNAME alongside L2TP_CMD_SESSION_CREATE and L2TP_CMD_SESSION_DELETE commands against the same tunnel, the attacker can manipulate the session list traversal mechanism. The commands require GENL_UNS_ADMIN_PERM permissions which are accessible through CAP_NET_ADMIN in a user namespace, making this exploit reachable from standard sandbox environments created with unshare -Urn.
The core flaw manifests when l2tp_session_unhash() employs list_del_init() to remove entries from tunnel->session_list. This operation leaves the deleted entry's next and prev pointers self-pointing, creating a loop that confuses the rcu reader in l2tp_session_get_by_ifname(). The reader advances through the list using list_for_each_entry_rcu() under rcu_read_lock_bh(), but encounters the self-referencing pointers and never reaches the list head. This results in an infinite loop within strcmp() inside the walker with bottom-half interrupts and preemption disabled, effectively pinning the cpu and preventing proper rcu grace period completion.
The operational impact extends beyond simple cpu pinning to system-wide stability concerns where RCU grace periods stall behind the wedged thread, making it impossible to terminate the problematic process even with SIGKILL signals. The affected kernel subsystem is particularly vulnerable when l2tp_core module is loaded, making any host susceptible to this attack vector regardless of other security mitigations. The fix implements list_del_rcu() matching the existing list_add_rcu() pattern in l2tp_session_register(), ensuring proper rcu synchronization where deleted sessions remain visible to in-flight readers until kfree_rcu() in l2tp_session_free() releases them completely.
This vulnerability aligns with CWE-362: Concurrent Execution using Shared Resource with Unprotected Read-Write Access and maps to ATT&CK technique T1059.004: Command and Scripting Interpreter: Unix Shell within the privilege escalation category. The fix addresses the inconsistency in list management operations while maintaining identical userspace behavior, as confirmed by the absence of any usage of list_empty(&session->list) after the unhash point. The solution leverages proper rcu semantics that are consistent with the kernel's established patterns for managing concurrent access to shared data structures, thereby preventing the race condition that enables indefinite cpu pinning and system degradation.
The resolution demonstrates a classic example of improper synchronization in kernel space where the deletion operation does not match the access pattern used by concurrent readers. The patch ensures consistency between list_add_rcu() and list_del_rcu() operations while maintaining the same functional interface for userspace applications. This type of vulnerability highlights the importance of careful rcu usage patterns throughout kernel subsystems and the potential for subtle concurrency issues to create significant system stability problems when not properly addressed through consistent synchronization primitives.