l2tp_udp_encap_recv() contains a code path that fails to release allocated resources when the protocol version validation errors. This leads to a memory leak of kernel objects such as l2tp_session, l2tp_tunnel, and socket structures. The unreferenced memory accumulates as L2TP sessions are created, which can progressively consume kernel memory and eventually cause a denial of service. The weakness is classified as CWE‑401.

All Linux kernel releases that contain the vulnerability, including the 6.19 series up to the latest kernel revision before the fix commit. The affected kernels are identified by CPE strings cpe:2.3:o:linux:linux_kernel:6.19:rc1, … rc6 and any other releases derived from these. In practice, any kernel version that has not incorporated the patch found in the 4d10edfd… commit is at risk. Vendors offering general Linux kernel packages should verify that their distribution has applied the same upstream change.

The CVSS v3.1 base score is 5.5, indicating moderate severity. EPSS shows an exploitation probability of less than 1 % and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. An attacker who can send L2TP UDP packets to the target machine could trigger the leak in multiple session creations. This requires network connectivity to the L2TP service and does not depend on user privileges; therefore, the attack vector is network‑based. Because resources are freed only on error, repeated exploitation can lead to kernel memory exhaustion.