CVE-2026-64119

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> l2tp: use list_del_rcu in l2tp_session_unhash<br /> <br /> An unprivileged local user can pin a host CPU indefinitely in<br /> l2tp_session_get_by_ifname() by issuing L2TP_CMD_SESSION_GET on<br /> L2TP_ATTR_IFNAME concurrently with L2TP_CMD_SESSION_CREATE and<br /> L2TP_CMD_SESSION_DELETE on the same tunnel. All three commands take<br /> GENL_UNS_ADMIN_PERM, so CAP_NET_ADMIN in the netns user namespace<br /> suffices; on any host that has l2tp_core loaded the trigger is<br /> reachable from a standard `unshare -Urn` sandbox.<br /> <br /> l2tp_session_unhash() removes a session from tunnel-&gt;session_list<br /> with list_del_init(), but that list is walked by<br /> l2tp_session_get_by_ifname() with list_for_each_entry_rcu() under<br /> rcu_read_lock_bh(). list_del_init() leaves the deleted entry&amp;#39;s<br /> next/prev self-pointing; a reader that has loaded the entry and<br /> then advances pos-&gt;list.next reads &amp;session-&gt;list, container_of()s<br /> back to the same session, and list_for_each_entry_rcu() never<br /> reaches the list head. The CPU stays in strcmp() inside the<br /> walker, with BH and preemption disabled, so RCU grace periods on<br /> the host stall behind it and the wedged thread cannot be killed<br /> (SIGKILL is delivered on syscall return).<br /> <br /> Use list_del_rcu() to match the existing list_add_rcu() in<br /> l2tp_session_register(); the deleted session remains visible to<br /> in-flight walkers with consistent next/prev pointers until<br /> kfree_rcu() in l2tp_session_free() releases it. tunnel-&gt;session_list<br /> has exactly one list_del_init() call site; the list_del_init<br /> (&amp;session-&gt;clist) at l2tp_core.c:533 operates on the per-collision<br /> list, which is not walked under RCU. list_empty(&amp;session-&gt;list) is<br /> not used anywhere in net/l2tp/ after the unhash point, so dropping<br /> the post-delete self-init is safe; the fix has no userspace-visible<br /> behavior change.