CVE-2026-74735

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> l2tp: fix tunnel and session refcount leak on seq_file release<br /> <br /> In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state<br /> (pd-&gt;tunnel and pd-&gt;session) is kept in seq_file private data to allow<br /> iteration across multiple read() system calls.<br /> <br /> However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels<br /> before reading to end-of-file (EOF), any tunnel or session reference stored in<br /> pd-&gt;tunnel / pd-&gt;session is left un-dropped when seq_file private data is freed.<br /> <br /> Fix this by dropping any remaining pd-&gt;tunnel and pd-&gt;session references in<br /> pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.