l2tp: avoid one data-race in l2tp_tunnel_del_work()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-23120
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-02-14 15:16:07 UTC
Updated2026-10-19 19:17:37 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: l2tp: avoid one data-race in l2tp_tunnel_del_work() We should read sk->sk_socket only when dealing with kernel sockets. syzbot reported the following data-race: BUG: KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release write to 0xffff88811c182b20 of 8 bytes by task 5365 on cpu 0: sk_set_socket include/net/sock.h:2092 [inline] sock_orphan include/net/sock.h:2118 [inline] sk_common_release+0xae/0x230 net/core/sock.c:4003 udp_lib_close+0x15/0x20 include/net/udp.h:325 inet_release+0xce/0xf0 net/ipv4/af_inet.c:437 __sock_release net/socket.c:662 [inline] sock_close+0x6b/0x150 net/socket.c:1455 __fput+0x29b/0x650 fs/file_table.c:468 ____fput+0x1c/0x30 fs/file_table.c:496 task_work_run+0x131/0x1a0 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0x1fe/0x740 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x1e1/0x2b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff88811c182b20 of 8 bytes by task 827 on cpu 1: l2tp_tunnel_del_work+0x2f/0x1a0 net/l2tp/l2tp_core.c:1418 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340 worker_thread+0x582/0x770 kernel/workqueue.c:3421 kthread+0x489/0x510 kernel/kthread.c:463 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 value changed: 0xffff88811b818000 -> 0x0000000000000000

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: NVD-CWE-noinfo | CWE-362 | CWE-362 CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected d00fa9adc528c1b0e64d532556764852df8bd7b9 1f63ca44b4f419a1663d94d1bb0b4e2beb73fdb4 git Not specified
CNA Linux Linux affected d00fa9adc528c1b0e64d532556764852df8bd7b9 36c40a80109f1771d59558050b1a71e13c60c759 git Not specified
CNA Linux Linux affected d00fa9adc528c1b0e64d532556764852df8bd7b9 eae074dab764ea181bbed5e88626889319177498 git Not specified
CNA Linux Linux affected d00fa9adc528c1b0e64d532556764852df8bd7b9 68e92085427c84e7679ddb53c0d68836d220b6e7 git Not specified
CNA Linux Linux affected d00fa9adc528c1b0e64d532556764852df8bd7b9 3d6d414b214ce31659bded2f8df50c93a3769474 git Not specified
CNA Linux Linux affected d00fa9adc528c1b0e64d532556764852df8bd7b9 32d417497b79efb403d75f4c185fe6fd9d64b94f git Not specified
CNA Linux Linux affected d00fa9adc528c1b0e64d532556764852df8bd7b9 7a29f6bf60f2590fe5e9c4decb451e19afad2bcf git Not specified
CNA Linux Linux affected 15df699fdc5af46a9fb15ae2d9326294852de5b5 git Not specified
CNA Linux Linux affected 18bdaefc715b4530b4b2fe670506bb47713664cc git Not specified
CNA Linux Linux affected 3.16.57 3.17 semver Not specified
CNA Linux Linux affected 4.15.8 4.16 semver Not specified
CNA Linux Linux affected 4.16 Not specified
CNA Linux Linux unaffected 4.16 semver Not specified
CNA Linux Linux unaffected 5.10.249 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.199 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.162 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.122 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.68 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.8 6.18.* semver Not specified
CNA Linux Linux unaffected 6.19 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/1f63ca44b4f419a1663d94d1bb0b4e2beb73fdb4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/36c40a80109f1771d59558050b1a71e13c60c759 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/eae074dab764ea181bbed5e88626889319177498 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/7a29f6bf60f2590fe5e9c4decb451e19afad2bcf 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/32d417497b79efb403d75f4c185fe6fd9d64b94f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/3d6d414b214ce31659bded2f8df50c93a3769474 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/68e92085427c84e7679ddb53c0d68836d220b6e7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report