CVE-2026-74735 - Vulnerability Details

- l2tp: fix tunnel and session refcount leak on seq_file release

Description

In the Linux kernel, the following vulnerability has been resolved:

l2tp: fix tunnel and session refcount leak on seq_file release

In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state
(pd->tunnel and pd->session) is kept in seq_file private data to allow
iteration across multiple read() system calls.

However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels
before reading to end-of-file (EOF), any tunnel or session reference stored in
pd->tunnel / pd->session is left un-dropped when seq_file private data is freed.

Fix this by dropping any remaining pd->tunnel and pd->session references in
pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.

Published: 2026-08-26

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel flaw in pppol2tp_proc_open and l2tp_dfs_seq_open left tunnel and session reference counts unreleased when a userspace process closed /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reaching end-of-file, causing a reference count leak that can lead to persistent memory usage or resource exhaustion when repeatedly opened and prematurely closed.

Affected Systems

All Linux kernel builds compiled with pppol2tp or the l2tp debugfs interface that are running the commit history before the patch are affected; the fix resides in the kernel tip and applies to mainstream kernel releases that enable these features.

Risk and Exploitability

The vulnerability can be exploited by a local attacker who can read and close the proc or debug entries before reaching EOF, resulting in a memory leak; the EPSS score is <1% indicating low probability of exploitation, and it is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443`	affected	< ebe2774e956482dd3c70b8991f6f7654356339e6
`0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443`	affected	< 9006c116dd111d457bf5d074990210f70a4ad2c8
`f6104e9ae04462523c372928b1173766a771ef95`	affected	—
`7f8e401f9e612df2a95c1ef76217c00181389bb5`	affected	—
`c712ed63e9b33d9a282fbd92ce25c64918c3129f`	affected	—
`9a8863e8a8def9d88583cd9c60db38a008e6b8cf`	affected	—
`3.16.60`	affected	< 3.17
`4.16.6`	affected	< 4.17

Linux

affected

Version	Status	Constraints
`4.17`	affected	—
`0`	unaffected	< 4.17
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443,ebe2774e956482dd3c70b8991f6f7654356339e6)`	affected	code_commit	—
`[0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443,9006c116dd111d457bf5d074990210f70a4ad2c8)`	affected	code_commit	—
`f6104e9ae04462523c372928b1173766a771ef95`	affected	code_commit	—
`7f8e401f9e612df2a95c1ef76217c00181389bb5`	affected	code_commit	—
`c712ed63e9b33d9a282fbd92ce25c64918c3129f`	affected	code_commit	—
`9a8863e8a8def9d88583cd9c60db38a008e6b8cf`	affected	code_commit	—
`[3.16.60,3.17)`	affected	semver	—
`[4.16.6,4.17)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.17`	affected	generic	—
`[0,4.17)`	unaffected	generic	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that drops lingering tunnel and session references (see commits 9006c116dd111d457bf5d074990210f70a4ad2c8 and ebe2774e956482dd3c70b8991f6f7654356339e6).
Restrict or remove access to /proc/net/pppol2tp and /sys/kernel/debug/l2tp/tunnels by adjusting file permissions or disabling debugfs for L2TP.
If L2TP is not required, unload the l2tp kernel module or stop L2TP services to eliminate the vulnerable vector.
Monitor kernel memory usage and the count of tunnel or session objects as a sentinel for potential leakage.

Generated by OpenCVE AI on August 28, 2026 at 19:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00162.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/9006c116dd111d457bf5d074990210f70a4ad2c8
https://git.kernel.org/stable/c/ebe2774e956482dd3c70b8991f6f7654356339e6
https://lore.kernel.org/linux-cve-announce/2026082656-CVE-2026-74735-e7ef@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74735
https://www.cve.org/CVERecord?id=CVE-2026-74735

History

Fri, 28 Aug 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-753

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026082656-CVE-2026-74735-e7ef@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74735 https://www.cve.org/CVERecord?id=CVE-2026-74735
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 26 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-753

Wed, 26 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: l2tp: fix tunnel and session refcount leak on seq_file release In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state (pd->tunnel and pd->session) is kept in seq_file private data to allow iteration across multiple read() system calls. However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reading to end-of-file (EOF), any tunnel or session reference stored in pd->tunnel / pd->session is left un-dropped when seq_file private data is freed. Fix this by dropping any remaining pd->tunnel and pd->session references in pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.
Title		l2tp: fix tunnel and session refcount leak on seq_file release
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/9006c116dd111d457bf5d074990210f70a4ad2c8 https://git.kernel.org/stable/c/ebe2774e956482dd3c70b8991f6f7654356339e6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-26T14:36:49.352Z

Updated: 2026-08-26T14:36:49.352Z

Reserved: 2026-08-15T05:44:03.930Z

Link: CVE-2026-74735

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-26T15:16:52.057

Modified: 2026-08-26T15:16:52.057

Link: CVE-2026-74735

Redhat

Severity : Moderate

Publid Date: 2026-08-26T00:00:00Z

Links: CVE-2026-74735 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-28T19:30:16Z

Weaknesses

CWE-911
Improper Update of Reference Count

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object