The vulnerability is caused by a race condition in the Linux kernel’s L2TP stack, specifically the l2tp_session_unhash() function. It incorrectly removes an l2tp session from the kernel’s list using list_del_init(), while session lookups walk that list with list_for_each_entry_rcu() on an RCU read lock. When a session is deleted, the removed entry’s next/prev pointers reference itself, causing a reader thread to spin indefinitely in a strcmp() call with preemption disabled. This results in a denial of service where the target CPU is permanently committed to a busy loop, and RCU grace periods are blocked, effectively freezing the kernel service on that host.

The flaw affects all Linux kernel builds that have the l2tp_core kernel module loaded. It is not limited to a particular kernel version; the advisory applies to any system running the default L2TP implementation in the kernel, regardless of distribution. Hosts that do not load or use the L2TP module are not affected.

The CVSS v3 base score is 7.0, indicating substantial impact. The EPSS score is listed as < 1 %, meaning the current model predicts a very low probability of exploitation in the wild. The vulnerability is not yet catalogued in CISA’s KEV list, and the exploit requires an unprivileged local user with CAP_NET_ADMIN, which can be granted through the NetAdmin capability or by using the L2TP commands. The attack vector is local, and the exploitation path involves orchestrating session creation, lookup, and deletion simultaneously to trigger the RCU spin. No arbitrary code execution or data exfiltration is possible; the primary risk is availability loss.