CVE-2024-49940

What it actually does

Race condition in L2TP session creation allows session->tunnel backpointer to be set before the tunnel refcount is incremented, enabling underflow on session free when colliding L2TPv3 IDs race l2tp_v3_session_get against l2tp_session_register.

Why it matters to the business

Systems relying on L2TP for VPN or tunneling may experience kernel instability, crashes, or memory corruption, disrupting network services and requiring urgent patching to avoid downtime or escalation risks.

How an attack unfolds

An attacker triggers concurrent L2TPv3 session creation with duplicate IDs; l2tp_v3_session_get can retrieve an incomplete session lacking the tunnel refcount bump, leading to underflow on free and potential kernel object misuse.

How to fix it

Apply the upstream kernel patch that moves the tunnel backpointer assignment into l2tp_session_register and adds an encap argument to l2tp_session_set_header_len; rebuild and deploy the fixed kernel on all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting l2tp_session.c for the updated assignment order and the encap parameter change; run kernel selftests for L2TP and verify no refcount warnings under concurrent session creation.

Typical attack path

1. Send crafted L2TP control or data packets to create sessions with colliding IDs
2. Race l2tp_session_create and l2tp_session_register paths
3. Trigger session refcount drop before tunnel refcount increment completes
4. Cause refcount underflow to corrupt kernel state or enable further exploitation

How to detect it

Review kernel logs for L2TP refcount warnings or underflow messages; inspect auditd or syscall traces around l2tp_session_create and l2tp_session_register calls during high session churn.

What your security team should do

• Prioritize kernel updates on all L2TP-enabled hosts within the next maintenance window
• Disable L2TP if not required or restrict it behind strict firewall rules
• Monitor for L2TP session creation anomalies in kernel logs
• Test the fix in a staging environment before broad rollout