Riskcovery

CVE-2026-74735

l2tp: fix tunnel and session refcount leak on seq_file release

State
Published
Severity
Not scored
Published
Aug 26, 2026
Updated
Oct 30, 2026
Reserved
Aug 15, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

l2tp: fix tunnel and session refcount leak on seq_file release

In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state (pd->tunnel and pd->session) is kept in seq_file private data to allow iteration across multiple read() system calls.

However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reading to end-of-file (EOF), any tunnel or session reference stored in pd->tunnel / pd->session is left un-dropped when seq_file private data is freed.

Fix this by dropping any remaining pd->tunnel and pd->session references in pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443 to before c38b723858a51d6ca4e56470b9f1087f23276772Affected
  • 0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443 to before bd897e414451fb34dfdf08b31899180e5ab7149bAffected
  • 0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443 to before bdf83613781956cc39798ed08321f74ab0467f4dAffected
  • 0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443 to before 8c4fde01bcf91f22b9c7ded8c3e14addd7ddd500Affected
  • 0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443 to before ebe2774e956482dd3c70b8991f6f7654356339e6Affected
  • 0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443 to before 9006c116dd111d457bf5d074990210f70a4ad2c8Affected
  • f6104e9ae04462523c372928b1173766a771ef95Affected
  • 7f8e401f9e612df2a95c1ef76217c00181389bb5Affected
  • c712ed63e9b33d9a282fbd92ce25c64918c3129fAffected
  • 9a8863e8a8def9d88583cd9c60db38a008e6b8cfAffected
  • 3.16.60 to before 3.17Affected
  • 4.16.6 to before 4.17Affected
LinuxLinux
  • 4.17Affected
  • before 4.17Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.111 through 6.12.*Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.1.10 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.