The Linux kernel flaw in pppol2tp_proc_open and l2tp_dfs_seq_open left tunnel and session reference counts unreleased when a userspace process closed /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before finishing the read. The faulty code omitted a defensive drop of any remaining pd->tunnel and pd->session references during seq_file release, causing a reference count leak. This vulnerability permits an attacker to cause persistent memory usage or resource exhaustion by repeatedly opening and prematurely closing the proc or debug entries, potentially leading to degraded system performance or instability.

All Linux kernel builds affected by the identified commit history, which lacks explicit compatible versions in the advisory. The fix resides in the tip of the kernel tree and is intended for all mainstream kernel releases that compile the pppol2tp and l2tp debugfs interfaces.

The vulnerability allows an attacker with local access to read and close /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reaching end‑of‑file, causing a reference count leak that can lead to memory or resource exhaustion over time. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog, so the likelihood of exploitation cannot be precisely quantified. However, the nature of the flaw suggests that repeated or automated use could degrade system stability.