CVE-2026-53262

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()<br /> <br /> pppol2tp_ioctl() read sock-&gt;sk-&gt;sk_user_data directly without any<br /> locks or reference counting. If a controllable sleep was induced during<br /> copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent<br /> socket close could trigger pppol2tp_session_close() asynchronously. This<br /> frees the l2tp_session structure via the l2tp_session_del_work workqueue.<br /> Upon resuming, the ioctl thread dereferences the stale session pointer,<br /> resulting in a Use-After-Free (UAF).<br /> <br /> Fix this by securely fetching the session reference using the RCU-safe,<br /> refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the<br /> session&amp;#39;s refcount across the sleep. We structured the function to exit<br /> via standard err breaks, guaranteeing that l2tp_session_put() is cleanly<br /> called on all return paths to drop the reference.<br /> <br /> To preserve existing behavior we validate the session and its magic<br /> signature only for the specific L2TP commands that require it. This<br /> ensures that generic/unknown ioctls called on an unconnected socket<br /> still return -ENOIOCTLCMD and correctly fall back to generic handlers<br /> (e.g. in sock_do_ioctl()).