Use-After-Free Vulnerability in Linux Kernel L2TP Protocol

CVE-2026-53262

What is CVE-2026-53262?

A vulnerability in the L2TP implementation of the Linux kernel can lead to a Use-After-Free condition. The issue arises when the function pppol2tp_ioctl() reads user data without appropriate locking or reference counting. If a controlled sleep occurs during the operation, a concurrent socket closure may trigger an asynchronous cleanup process, leading to the use of a stale pointer once the ioctl thread resumes. The vulnerability has been mitigated by employing an RCU-safe, refcounted helper to securely manage session references, ensuring proper access across potential sleep conditions. Existing behaviors were preserved for specific L2TP commands, maintaining robust handling of ioctls on unconnected sockets.

References