- 7.8HighCVSS base score
- 0.12%Exploitation in 30 daysEPSS · top 98% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol2tp_ioctl() read sock->sk->sk_user_data directly without any locks or reference counting. If a controllable sleep was induced during copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger pppol2tp_session_close() asynchronously. This frees the l2tp_session structure via the l2tp_session_del_work workqueue. Upon resuming, the ioctl thread dereferences the stale session pointer, resulting in a Use-After-Free (UAF). Fix this by securely fetching the session reference using the RCU-safe, refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the session's refcount across the sleep. We structured the function to exit via standard err breaks, guaranteeing that l2tp_session_put() is cleanly called on all return paths to drop the reference. To preserve existing behavior we validate the session and its magic signature only for the specific L2TP commands that require it. This ensures that generic/unknown ioctls called on an unconnected socket still return -ENOIOCTLCMD and correctly fall back to generic handlers (e.g. in sock_do_ioctl()).
Timeline
ID reserved
By Linux
- 16 days later
· 16 days later
Published
- 4 months later
· 4 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.12% · top 98% of all CVEs (10 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected fd558d186df2c13a22455373858bae634a4795af – < cc19c164a99ab706d4cb45d3c300b305c16798b5
- affected fd558d186df2c13a22455373858bae634a4795af – < 312ecea13b67797747eb9d4b9dab8d3846de6dfb
- affected fd558d186df2c13a22455373858bae634a4795af – < 78cdfdca88cbf731a92f3b9ee5427c633dd94e28
- affected fd558d186df2c13a22455373858bae634a4795af – < e251d4cdfc725c9e7d686161e3b775a0e7d95053
- affected fd558d186df2c13a22455373858bae634a4795af – < 62f327e287cf7b595ae3f73ba72f5cd2a9e9f39f
- affected fd558d186df2c13a22455373858bae634a4795af – < a213a8950414c684999dcf03edeea6c46ede172e
- affected 2.6.35
- unaffected < 2.6.35
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.94 – ≤ 6.12.*
- unaffected 6.18.36 – ≤ 6.18.*
- unaffected 7.0.13 – ≤ 7.0.*
- unaffected 7.1 – ≤ *
References
6
- https://git.kernel.org/stable/c/cc19c164a99ab706d4cb45d3c300b305c16798b5 (opens in a new tab)
- https://git.kernel.org/stable/c/312ecea13b67797747eb9d4b9dab8d3846de6dfb (opens in a new tab)
- https://git.kernel.org/stable/c/78cdfdca88cbf731a92f3b9ee5427c633dd94e28 (opens in a new tab)
- https://git.kernel.org/stable/c/e251d4cdfc725c9e7d686161e3b775a0e7d95053 (opens in a new tab)
- https://git.kernel.org/stable/c/62f327e287cf7b595ae3f73ba72f5cd2a9e9f39f (opens in a new tab)
- https://git.kernel.org/stable/c/a213a8950414c684999dcf03edeea6c46ede172e (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-39213 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-53262)Record last updated .