CVE-2026-74735

Summary

In the Linux kernel, the following vulnerability has been resolved:

l2tp: fix tunnel and session refcount leak on seq_file release

In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state (pd->tunnel and pd->session) is kept in seq_file private data to allow iteration across multiple read() system calls.

However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reading to end-of-file (EOF), any tunnel or session reference stored in pd->tunnel / pd->session is left un-dropped when seq_file private data is freed.

Fix this by dropping any remaining pd->tunnel and pd->session references in pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443 < ebe2774e956482dd3c70b8991f6f7654356339e6affected
LinuxLinux0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443 < 9006c116dd111d457bf5d074990210f70a4ad2c8affected
LinuxLinuxf6104e9ae04462523c372928b1173766a771ef95affected
LinuxLinux7f8e401f9e612df2a95c1ef76217c00181389bb5affected
LinuxLinuxc712ed63e9b33d9a282fbd92ce25c64918c3129faffected
LinuxLinux9a8863e8a8def9d88583cd9c60db38a008e6b8cfaffected
LinuxLinux3.16.60 < 3.17affected
LinuxLinux4.16.6 < 4.17affected
LinuxLinux4.17affected
LinuxLinux0 < 4.17unaffected
LinuxLinux7.1.10 <= 7.1.*unaffected
LinuxLinux7.2 <= *unaffected

Weaknesses

References