CVE-2024-26752

What it actually does

Incorrect C operator precedence in l2tp_ip6_sendmsg causes ulen to be set to transhdrlen for any non-zero length message instead of conditionally adding it only when the write queue is empty, leading ip6_append_data to receive the wrong length and produce corrupted packets on the wire.

Why it matters to the business

Systems relying on L2TP over IPv6 may experience unreliable tunneling or VPN connectivity with data corruption, though the issue is narrow and has not been observed in active exploitation campaigns.

How an attack unfolds

An attacker would need to trigger the L2TP IPv6 send path under conditions where skb_queue_empty returns false for a partially filled skbuff; the resulting length miscalculation produces malformed packets that may disrupt communication but do not directly grant code execution or privilege escalation.

How to fix it

Upgrade Linux kernels to a fixed release such as 4.19.308 or apply the commit 4c3ce64bc9d36ca9164dd6c77ff144c121011aae (or later) that adds parentheses to correct the ulen calculation; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the running kernel version contains the fix, inspect the l2tp source for the corrected ulen expression with parentheses, and test L2TP/IPv6 message transmission to confirm packets are no longer corrupted.

Typical attack path

1. Establish or trigger an L2TP/IPv6 session that uses sk_write_queue
2. Send a message when the queue already holds partial data
3. Observe on-wire packet corruption due to incorrect ulen passed to ip6_append_data

How to detect it

Examine network captures for malformed L2TP/IPv6 packets originating from affected kernels and review system logs for L2TP sendmsg errors; no widespread exploitation indicators have been published.

What your security team should do

• Prioritize kernel upgrades on any hosts using L2TP over IPv6
• Review network configurations for L2TP/IPv6 usage and schedule patching during maintenance windows
• Monitor vendor advisories for backported fixes in distribution kernels