CVE-2022-4129

What it actually does

Missing lock during sk_user_data clearing in the L2TP implementation creates a race condition that results in a NULL pointer dereference when concurrent operations access the socket structure.

Why it matters to the business

Local users can trigger system crashes leading to denial of service; the issue affects systems using L2TP networking and has low public exploit likelihood despite being known for years.

How an attack unfolds

An attacker with local access crafts concurrent operations against an L2TP socket to win the race on sk_user_data clearing, dereferencing a NULL pointer and crashing the kernel.

How to fix it

Apply the kernel fix or update affected packages; for wordpress/wordpress-develop (GIT) upgrade to commit 1c0a2efa5eac05dfd3b7d2b9cfe68e02da55b966.

How to confirm the fix worked

Verify the presence of the locking change around sk_user_data clearing in L2TP code paths and confirm the system no longer panics under concurrent L2TP socket operations.

Typical attack path

1. Obtain local user access on an affected system
2. Identify or create an L2TP socket context
3. Trigger simultaneous operations that race on sk_user_data clearing
4. Cause NULL pointer dereference resulting in kernel panic

How to detect it

Inspect kernel logs for NULL pointer dereference oops in L2TP modules and correlate with unusual local process activity around socket creation.

What your security team should do

• Prioritize patching systems that expose L2TP functionality even if EPSS remains low
• Review local user access controls as a compensating control until patches are deployed
• Monitor for kernel oops or panic logs related to L2TP sockets