CVE-2026-23120

l2tp: avoid one data-race in l2tp_tunnel_del_work()

State: Published
Severity: Not scored
Published: Feb 14, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

l2tp: avoid one data-race in l2tp_tunnel_del_work()

We should read sk->sk_socket only when dealing with kernel sockets.

syzbot reported the following data-race:

BUG: KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release

write to 0xffff88811c182b20 of 8 bytes by task 5365 on cpu 0: sk_set_socket include/net/sock.h:2092 [inline] sock_orphan include/net/sock.h:2118 [inline] sk_common_release+0xae/0x230 net/core/sock.c:4003 udp_lib_close+0x15/0x20 include/net/udp.h:325 inet_release+0xce/0xf0 net/ipv4/af_inet.c:437 __sock_release net/socket.c:662 [inline] sock_close+0x6b/0x150 net/socket.c:1455 __fput+0x29b/0x650 fs/file_table.c:468 ____fput+0x1c/0x30 fs/file_table.c:496 task_work_run+0x131/0x1a0 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0x1fe/0x740 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x1e1/0x2b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811c182b20 of 8 bytes by task 827 on cpu 1: l2tp_tunnel_del_work+0x2f/0x1a0 net/l2tp/l2tp_core.c:1418 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340 worker_thread+0x582/0x770 kernel/workqueue.c:3421 kthread+0x489/0x510 kernel/kthread.c:463 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

value changed: 0xffff88811b818000 -> 0x0000000000000000

Scores

The record has no CVSS score.

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	d00fa9adc528c1b0e64d532556764852df8bd7b9 to before 1f63ca44b4f419a1663d94d1bb0b4e2beb73fdb4Affected d00fa9adc528c1b0e64d532556764852df8bd7b9 to before 36c40a80109f1771d59558050b1a71e13c60c759Affected d00fa9adc528c1b0e64d532556764852df8bd7b9 to before eae074dab764ea181bbed5e88626889319177498Affected d00fa9adc528c1b0e64d532556764852df8bd7b9 to before 68e92085427c84e7679ddb53c0d68836d220b6e7Affected d00fa9adc528c1b0e64d532556764852df8bd7b9 to before 3d6d414b214ce31659bded2f8df50c93a3769474Affected d00fa9adc528c1b0e64d532556764852df8bd7b9 to before 32d417497b79efb403d75f4c185fe6fd9d64b94fAffected d00fa9adc528c1b0e64d532556764852df8bd7b9 to before 7a29f6bf60f2590fe5e9c4decb451e19afad2bcfAffected 15df699fdc5af46a9fb15ae2d9326294852de5b5Affected 18bdaefc715b4530b4b2fe670506bb47713664ccAffected 3.16.57 to before 3.17Affected 4.15.8 to before 4.16Affected
LinuxLinux	4.16Affected before 4.16Not affected 5.10.249 through 5.10.Not affected 5.15.199 through 5.15.Not affected 6.1.162 through 6.1.Not affected 6.6.122 through 6.6.Not affected 6.12.68 through 6.12.Not affected 6.18.8 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

d00fa9adc528c1b0e64d532556764852df8bd7b9 to before 1f63ca44b4f419a1663d94d1bb0b4e2beb73fdb4Affected
d00fa9adc528c1b0e64d532556764852df8bd7b9 to before 36c40a80109f1771d59558050b1a71e13c60c759Affected
d00fa9adc528c1b0e64d532556764852df8bd7b9 to before eae074dab764ea181bbed5e88626889319177498Affected
d00fa9adc528c1b0e64d532556764852df8bd7b9 to before 68e92085427c84e7679ddb53c0d68836d220b6e7Affected
d00fa9adc528c1b0e64d532556764852df8bd7b9 to before 3d6d414b214ce31659bded2f8df50c93a3769474Affected
d00fa9adc528c1b0e64d532556764852df8bd7b9 to before 32d417497b79efb403d75f4c185fe6fd9d64b94fAffected
d00fa9adc528c1b0e64d532556764852df8bd7b9 to before 7a29f6bf60f2590fe5e9c4decb451e19afad2bcfAffected
15df699fdc5af46a9fb15ae2d9326294852de5b5Affected
18bdaefc715b4530b4b2fe670506bb47713664ccAffected
3.16.57 to before 3.17Affected
4.15.8 to before 4.16Affected

LinuxLinux

4.16Affected
before 4.16Not affected
5.10.249 through 5.10.*Not affected
5.15.199 through 5.15.*Not affected
6.1.162 through 6.1.*Not affected
6.6.122 through 6.6.*Not affected
6.12.68 through 6.12.*Not affected
6.18.8 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.