A concurrent data‑race has been discovered in the Linux kernel L2TP implementation when deleting a tunnel, causing a clash between a socket cleanup routine and a workqueue thread that still holds a reference to the socket. The race allows memory corruption that can lead to a kernel crash, denying service and potentially enabling further compromise if additional vulnerabilities are chained. The flaw is a classic race condition (CWE‑362).

The vulnerability is present in all Linux kernel versions from 4.16 onward, including the listed release builds through 6.19 RC6. All Linux distributions shipping these kernel releases are affected, regardless of vendor or distribution version.

The CVSS score of 5.5 and an EPSS score below 1 % reflect a medium‑severity issue with a currently low exploitation probability. Nevertheless, the race can corrupt kernel memory and trigger a crash, presenting a local attack vector that would require an attacker to influence L2TP tunnel lifecycle or execute code in kernel space with elevated privileges. No publicly known exploits are listed in the KEV catalog, so exploitation depends on custom or internal tooling.