Cloudanix VulnDB

CVE-2026-23120

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Feb 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in network tunnel handling on Linux systems could let someone with local access crash or disrupt network connections.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Data race in l2tp_tunnel_del_work allows concurrent read of sk->sk_socket while sk_common_release writes it during socket orphaning and closure, leading to use of invalid or null socket pointers.

Why it matters to the business

Local users on affected Linux systems can trigger kernel instability or denial of service affecting L2TP-based network tunnels and connectivity services.

How an attack unfolds

A local attacker creates L2TP tunnels and concurrently triggers socket release paths, racing the tunnel deletion workqueue against socket close to read freed or inconsistent socket state and cause a crash.

How to fix it

Apply kernel patches that guard sk->sk_socket reads in l2tp_tunnel_del_work to occur only for kernel sockets. For listed Chainguard images, update to versions containing the fix (all marked fixed in 0 indicate resolution via base kernel update).

How to confirm the fix worked

Rebuild with KCSAN enabled and confirm absence of the reported race; verify source change that conditions the sk_socket read on kernel socket context.

Typical attack path

  1. Obtain local user access on a vulnerable Linux kernel
  2. Create and configure L2TP tunnels via user-space tools
  3. Trigger concurrent socket close and tunnel deletion operations
  4. Observe or force the data race leading to kernel panic or DoS

How to detect it

Search kernel logs and KCSAN reports for data-race mentions between l2tp_tunnel_del_work and sk_common_release or sock_orphan.

  • KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
  • BUG: KCSAN: data-race in l2tp_tunnel_del_work

What your security team should do

  • Prioritize kernel updates on all systems exposing L2TP
  • Limit local untrusted user access to reduce attack surface
  • Monitor kernel logs for KCSAN reports involving l2tp or sock code

The record

In the Linux kernel, the following vulnerability has been resolved: l2tp: avoid one data-race in l2tp_tunnel_del_work() We should read sk->sk_socket only when dealing with kernel sockets. syzbot reported the following data-race: BUG: KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release write to 0xffff88811c182b20 of 8 bytes by task 5365 on cpu 0: sk_set_socket include/net/sock.h:2092 [inline] sock_orphan include/net/sock.h:2118 [inline] sk_common_release+0xae/0x230 net/core/sock.c:4003 udp_lib_close+0x15/0x20 include/net/udp.h:325 inet_release+0xce/0xf0 net/ipv4/af_inet.c:437 __sock_release net/socket.c:662 [inline] sock_close+0x6b/0x150 net/socket.c:1455 __fput+0x29b/0x650 fs/file_table.c:468 ____fput+0x1c/0x30 fs/file_table.c:496 task_work_run+0x131/0x1a0 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0x1fe/0x740 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x1e1/0x2b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff88811c182b20 of 8 bytes by task 827 on cpu 1: l2tp_tunnel_del_work+0x2f/0x1a0 net/l2tp/l2tp_core.c:1418 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340 worker_thread+0x582/0x770 kernel/workqueue.c:3421 kthread+0x489/0x510 kernel/kthread.c:463 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 value changed: 0xffff88811b818000 -> 0x0000000000000000

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 4.16.0 5.10.249
openSUSE:Leap 16.0 dtb-aarch64 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-64kb 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-azure 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-default 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-default-base 0 6.12.0-160000.27.1.160000.2.8
openSUSE:Leap 16.0 kernel-docs 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-kvmsmall 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-obs-build 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-obs-qa 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-rt 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-source 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-syms 0 6.12.0-160000.28.1
openSUSE:Leap 16.0 kernel-zfcpdump 0 6.12.0-160000.28.1

Related vulnerabilities