CVE-2026-63918

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A mistake in how the Linux kernel tracks network connection sessions can let someone who already has access to the machine crash the system or potentially run their own code.

Exploitation: Local Privilege
Attacker needs: Low Privilege
Complexity: Moderate
Impact: Full Compromise
Component: OS kernel
Class: Use After Free
Remediation: Patch
Effort: Medium
Patch risk: Low

What it actually does

Race in l2tp_session_get_by_ifname performs refcount_inc on a session whose refcount reached zero via concurrent l2tp_session_free, allowing slab use-after-free once the RCU grace period expires.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or memory corruption leading to denial of service or potential privilege escalation; 99 days have passed since disclosure with low and declining exploit probability.

How an attack unfolds

An attacker with local access creates and deletes L2TP sessions while racing an ifname lookup inside rcu_read_lock_bh, causing the getter to return a pointer whose backing memory is freed after the grace period.

How to fix it

Upgrade the Linux kernel to a version containing the patch that replaces refcount_inc with refcount_inc_not_zero and continues the walk on failure in l2tp_session_get_by_ifname.

How to confirm the fix worked

Inspect net/l2tp/l2tp_core.c for the updated getter using refcount_inc_not_zero, boot the patched kernel, and confirm absence of the refcount addition on zero warning under L2TP session churn.

Typical attack path

Obtain local user privileges on a Linux host
Create L2TP sessions and trigger concurrent ifname lookups
Force refcount to zero on one CPU while inc occurs on another
Dereference the returned session after RCU grace period to hit UAF

How to detect it

Search kernel logs and dmesg for the exact refcount warning string emitted on addition to zero; correlate with L2TP session creation/deletion activity around the same timestamp.

refcount_t: addition on 0; use-after-free

What your security team should do

Prioritize kernel updates for systems exposing L2TP interfaces
Apply the fix within standard patch windows given low EPSS and no KEV listing
Review downstream distributions for backported fixes given Linux ecosystem prevalence

The record

In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname A reader in l2tp_session_get_by_ifname() can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plain refcount_inc(), but every other session getter in the same file (l2tp_v2_session_get, l2tp_v3_session_get, and the corresponding _get_next variants) uses refcount_inc_not_zero() because the IDR/RCU lookup can race with refcount_dec_and_test() -> l2tp_session_free() -> kfree_rcu(). The ifname getter is the only outlier; the inconsistency was raised on-list after 979c017803c4 ("l2tp: use list_del_rcu in l2tp_session_unhash"). A reader inside rcu_read_lock_bh() that matches session->ifname can be preempted between the strcmp() and the refcount_inc(). If the last reference drops on another CPU in that window, the reader's refcount_inc() runs on a counter that has reached zero. refcount_t catches the addition-on-zero, prints "refcount_t: addition on 0; use-after-free", saturates the counter, and returns the saturated pointer to the caller. Session memory is held live by the in-flight RCU read section, but the kfree_rcu() callback queued from l2tp_session_free() will free it once the grace period closes; a caller that dereferences the returned session past that point hits a slab-use-after-free. On PREEMPT_RT local_bh_disable() is a per-CPU sleeping lock and the preemption window is real; on stock PREEMPT kernels local_bh_disable() is a preempt_count increment that closes the cross-CPU race in practice (see below). Use refcount_inc_not_zero() and continue the list walk on failure, matching the other session getters in the file. The ifname getter is the only session getter in net/l2tp/ that still uses the bare refcount_inc() pattern; this change restores file-internal consistency. The success path is unchanged.

Affected packages

Ecosystem	Package	Introduced	Fixed