The vulnerability arises when pppol reads a socket's session pointer without holding a reference, and during copy_from_user a controllable sleep can be induced. If the socket is closed concurrently, the session is freed, and when the ioctl resumes it dereferences the stale pointer. This use‑after‑free can corrupt kernel memory and may be leveraged by a local user with access to L2TP sockets to achieve privilege escalation. The weakness is a classic kernel memory corruption flaw.

The affected product is the Linux kernel, where any build that includes the pppol2tp module using the vulnerable ioctl path is impacted. No specific version ranges are given in the data, so any kernel prior to the commit that introduces the reference‑counted helper pppol2tp_sock_to_session may be vulnerable.

No CVSS or EPSS score is available, and the vulnerability is not listed in KEV. The flaw is a kernel use‑after‑free, which normally represents a high‑severity local privilege escalation. A local attacker must be able to open a L2TP socket, invoke the ioctl, and induce a sleep (e.g., via userfaultfd). The attack vector is thus inferred to be local user context. Because of the absence of exploitation data, the exact likelihood of remote exploitation is unknown, but the potential impact is significant.