CVE-2026-74735

l2tp: fix tunnel and session refcount leak on seq_file release

Published Aug 26, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

l2tp: fix tunnel and session refcount leak on seq_file release

In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state
(pd->tunnel and pd->session) is kept in seq_file private data to allow
iteration across multiple read() system calls.

However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels
before reading to end-of-file (EOF), any tunnel or session reference stored in
pd->tunnel / pd->session is left un-dropped when seq_file private data is freed.

Fix this by dropping any remaining pd->tunnel and pd->session references in
pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.

Analysis

Technical impact

The Linux kernel flaw in pppol2tp_proc_open and l2tp_dfs_seq_open left tunnel and session reference counts unreleased when a userspace process closed /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reaching end-of-file, causing a reference count leak that can lead to persistent memory usage or resource exhaustion when repeatedly opened and prematurely closed.

Affected Systems

All Linux kernel builds compiled with pppol2tp or the l2tp debugfs interface that are running the commit history before the patch are affected; the fix resides in the kernel tip and applies to mainstream kernel releases that enable these features.

Risk and Exploitability

The vulnerability can be exploited by a local attacker who can read and close the proc or debug entries before reaching EOF, resulting in a memory leak; the EPSS score is <1% indicating low probability of exploitation, and it is not listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443`	affected	< c38b723858a51d6ca4e56470b9f1087f23276772
`0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443`	affected	< bd897e414451fb34dfdf08b31899180e5ab7149b
`0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443`	affected	< bdf83613781956cc39798ed08321f74ab0467f4d
`0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443`	affected	< 8c4fde01bcf91f22b9c7ded8c3e14addd7ddd500
`0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443`	affected	< ebe2774e956482dd3c70b8991f6f7654356339e6
`0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443`	affected	< 9006c116dd111d457bf5d074990210f70a4ad2c8
`f6104e9ae04462523c372928b1173766a771ef95`	affected	—
`7f8e401f9e612df2a95c1ef76217c00181389bb5`	affected	—
`c712ed63e9b33d9a282fbd92ce25c64918c3129f`	affected	—
`9a8863e8a8def9d88583cd9c60db38a008e6b8cf`	affected	—
`3.16.60`	affected	< 3.17
`4.16.6`	affected	< 4.17

Linux

affected

Version	Status	Constraints
`4.17`	affected	—
`0`	unaffected	< 4.17
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443,ebe2774e956482dd3c70b8991f6f7654356339e6)`	affected	code_commit	—
`[0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443,9006c116dd111d457bf5d074990210f70a4ad2c8)`	affected	code_commit	—
`f6104e9ae04462523c372928b1173766a771ef95`	affected	code_commit	—
`7f8e401f9e612df2a95c1ef76217c00181389bb5`	affected	code_commit	—
`c712ed63e9b33d9a282fbd92ce25c64918c3129f`	affected	code_commit	—
`9a8863e8a8def9d88583cd9c60db38a008e6b8cf`	affected	code_commit	—
`[3.16.60,3.17)`	affected	semver	—
`[4.16.6,4.17)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.17`	affected	generic	—
`[0,4.17)`	unaffected	generic	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that drops lingering tunnel and session references (see commits 9006c116dd111d457bf5d074990210f70a4ad2c8 and ebe2774e956482dd3c70b8991f6f7654356339e6).
Restrict or remove access to /proc/net/pppol2tp and /sys/kernel/debug/l2tp/tunnels by adjusting file permissions or disabling debugfs for L2TP.
If L2TP is not required, unload the l2tp kernel module or stop L2TP services to eliminate the vulnerable vector.
Monitor kernel memory usage and the count of tunnel or session objects as a sentinel for potential leakage.

Generated by OpenCVE AI on August 28, 2026 at 19:27 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.215% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/8c4fde01bcf91f22b9c7ded8c3e14addd7ddd500
https://git.kernel.org/stable/c/9006c116dd111d457bf5d074990210f70a4ad2c8
https://git.kernel.org/stable/c/bd897e414451fb34dfdf08b31899180e5ab7149b
https://git.kernel.org/stable/c/bdf83613781956cc39798ed08321f74ab0467f4d
https://git.kernel.org/stable/c/c38b723858a51d6ca4e56470b9f1087f23276772
https://git.kernel.org/stable/c/ebe2774e956482dd3c70b8991f6f7654356339e6
https://lore.kernel.org/linux-cve-announce/2026082656-CVE-2026-74735-e7ef@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74735
https://www.cve.org/CVERecord?id=CVE-2026-74735

History

Oct 30, 2026 12:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/c38b723858a51d6ca4e56470b9f1087f23276772

Oct 21, 2026 1:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/bd897e414451fb34dfdf08b31899180e5ab7149b

Sep 21, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/8c4fde01bcf91f22b9c7ded8c3e14addd7ddd500 https://git.kernel.org/stable/c/bdf83613781956cc39798ed08321f74ab0467f4d

Aug 28, 2026 6:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-753

Aug 27, 2026 6:00 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026082656-CVE-2026-74735-e7ef@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74735 https://www.cve.org/CVERecord?id=CVE-2026-74735
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Aug 26, 2026 4:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-753

Aug 26, 2026 2:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: l2tp: fix tunnel and session refcount leak on seq_file release In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state (pd->tunnel and pd->session) is kept in seq_file private data to allow iteration across multiple read() system calls. However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reading to end-of-file (EOF), any tunnel or session reference stored in pd->tunnel / pd->session is left un-dropped when seq_file private data is freed. Fix this by dropping any remaining pd->tunnel and pd->session references in pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.
Title		l2tp: fix tunnel and session refcount leak on seq_file release
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/9006c116dd111d457bf5d074990210f70a4ad2c8 https://git.kernel.org/stable/c/ebe2774e956482dd3c70b8991f6f7654356339e6