Cloudanix VulnDB

CVE-2026-64119

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel lets a local user freeze one of the computer's processors, forcing a full restart to get the system working again.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use of list_del_init() on an RCU-protected list allows a concurrent reader in l2tp_session_get_by_ifname() to enter an infinite loop inside strcmp() with BH and preemption disabled, stalling RCU grace periods.

Why it matters to the business

A local user with network namespace capabilities can render a system unresponsive on any host with the l2tp_core module loaded, requiring a reboot to recover and disrupting all workloads until resolved.

How an attack unfolds

An attacker creates a user namespace, loads l2tp_core if needed, then concurrently issues L2TP_CMD_SESSION_CREATE, L2TP_CMD_SESSION_DELETE, and L2TP_CMD_SESSION_GET on the same tunnel to trigger the list corruption and wedge a CPU.

How to fix it

Apply the upstream patch that replaces list_del_init() with list_del_rcu() in l2tp_session_unhash() and ensure kfree_rcu() ordering is preserved; rebuild and deploy the fixed kernel across all affected systems.

How to confirm the fix worked

Confirm the presence of list_del_rcu() at the single call site in l2tp_session_unhash() and verify that list_for_each_entry_rcu() walks terminate correctly under concurrent create/delete/get operations.

Typical attack path

  1. Obtain CAP_NET_ADMIN in a user namespace via unshare -Urn
  2. Create an L2TP tunnel and issue L2TP_CMD_SESSION_CREATE
  3. Concurrently issue L2TP_CMD_SESSION_DELETE and repeated L2TP_CMD_SESSION_GET on the same ifname
  4. Observe target CPU pinned with interrupts disabled and RCU stalls

How to detect it

Inspect kernel logs for RCU CPU stall warnings, soft lockup messages, or processes stuck inside l2tp_session_get_by_ifname; correlate with audit records of L2TP netlink commands from unprivileged namespaces.

What your security team should do

  • Prioritize kernel updates on all systems exposing L2TP interfaces or allowing user namespaces
  • Restrict CAP_NET_ADMIN and user-namespace creation via seccomp or policy where L2TP is not required
  • Monitor for RCU stall warnings and sustained high CPU in kernel threads after L2TP activity

The record

In the Linux kernel, the following vulnerability has been resolved: l2tp: use list_del_rcu in l2tp_session_unhash An unprivileged local user can pin a host CPU indefinitely in l2tp_session_get_by_ifname() by issuing L2TP_CMD_SESSION_GET on L2TP_ATTR_IFNAME concurrently with L2TP_CMD_SESSION_CREATE and L2TP_CMD_SESSION_DELETE on the same tunnel. All three commands take GENL_UNS_ADMIN_PERM, so CAP_NET_ADMIN in the netns user namespace suffices; on any host that has l2tp_core loaded the trigger is reachable from a standard `unshare -Urn` sandbox. l2tp_session_unhash() removes a session from tunnel->session_list with list_del_init(), but that list is walked by l2tp_session_get_by_ifname() with list_for_each_entry_rcu() under rcu_read_lock_bh(). list_del_init() leaves the deleted entry's next/prev self-pointing; a reader that has loaded the entry and then advances pos->list.next reads &session->list, container_of()s back to the same session, and list_for_each_entry_rcu() never reaches the list head. The CPU stays in strcmp() inside the walker, with BH and preemption disabled, so RCU grace periods on the host stall behind it and the wedged thread cannot be killed (SIGKILL is delivered on syscall return). Use list_del_rcu() to match the existing list_add_rcu() in l2tp_session_register(); the deleted session remains visible to in-flight walkers with consistent next/prev pointers until kfree_rcu() in l2tp_session_free() releases it. tunnel->session_list has exactly one list_del_init() call site; the list_del_init (&session->clist) at l2tp_core.c:533 operates on the per-collision list, which is not walked under RCU. list_empty(&session->list) is not used anywhere in net/l2tp/ after the unhash point, so dropping the post-delete self-init is safe; the fix has no userspace-visible behavior change.

Affected packages

Ecosystem Package Introduced Fixed