{"api_version":"1","generated_at":"2026-10-21T17:39:17+00:00","cve":"CVE-2024-49940","urls":{"html":"https://cve.report/CVE-2024-49940","api":"https://cve.report/api/cve/CVE-2024-49940.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-49940","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-49940"},"summary":{"title":"l2tp: prevent possible tunnel refcount underflow","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: prevent possible tunnel refcount underflow\n\nWhen a session is created, it sets a backpointer to its tunnel. When\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\nrefcount if session->tunnel is non-NULL. However, session->tunnel is\nset in l2tp_session_create, before the tunnel refcount is incremented\nby l2tp_session_register, which leaves a small window where\nsession->tunnel is non-NULL when the tunnel refcount hasn't been\nbumped.\n\nMoving the assignment to l2tp_session_register is trivial but\nl2tp_session_create calls l2tp_session_set_header_len which uses\nsession->tunnel to get the tunnel's encap. Add an encap arg to\nl2tp_session_set_header_len to avoid using session->tunnel.\n\nIf l2tpv3 sessions have colliding IDs, it is possible for\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\nsession which doesn't yet have session->tunnel set. Add a check for\nthis case.","state":"PUBLISHED","assigner":"Linux","published_at":"2024-10-21 18:15:15","updated_at":"2026-10-21 13:17:49"},"problem_types":["NVD-CWE-noinfo"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950","name":"https://git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02","name":"https://git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/98691b2e28a6c3dac0680914493d54c77f215755","name":"https://git.kernel.org/stable/c/98691b2e28a6c3dac0680914493d54c77f215755","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-49940","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49940","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3953ae7b218df4d1e544b98a393666f9ae58a78c 98691b2e28a6c3dac0680914493d54c77f215755 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3953ae7b218df4d1e544b98a393666f9ae58a78c f7415e60c25a6108cd7955a20b2e66b6251ffe02 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3953ae7b218df4d1e544b98a393666f9ae58a78c 24256415d18695b46da06c93135f5b51c548b950 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b102bfc2a90d14f342580285782a9a51c74f7369 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 10c15ddabbcf888922adbdd44ca3fecf6eab19d9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 8d1c650d452c53fcb3f02a7b1d772741639f89a4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 12b5fb58ac993c24210cf8cbc72d407d3a4e6490 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected aef37401b467a0b1a9517c69924a1d66937e0789 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.2.99 3.3 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.16.54 3.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.4.225 4.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.9.225 4.10 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.14.182 4.15 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.15","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.15 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.160 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.11.3 6.11.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2024","cve_id":"49940","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2024","cve_id":"49940","cve":"CVE-2024-49940","epss":"0.002220000","percentile":"0.127650000","score_date":"2026-08-06","updated_at":"2026-08-07 00:14:20"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2024-49940","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-10-22T13:37:52.827630Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-10-22T13:38:50.656Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/l2tp/l2tp_core.c","net/l2tp/l2tp_core.h","net/l2tp/l2tp_netlink.c","net/l2tp/l2tp_ppp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"98691b2e28a6c3dac0680914493d54c77f215755","status":"affected","version":"3953ae7b218df4d1e544b98a393666f9ae58a78c","versionType":"git"},{"lessThan":"f7415e60c25a6108cd7955a20b2e66b6251ffe02","status":"affected","version":"3953ae7b218df4d1e544b98a393666f9ae58a78c","versionType":"git"},{"lessThan":"24256415d18695b46da06c93135f5b51c548b950","status":"affected","version":"3953ae7b218df4d1e544b98a393666f9ae58a78c","versionType":"git"},{"status":"affected","version":"b102bfc2a90d14f342580285782a9a51c74f7369","versionType":"git"},{"status":"affected","version":"10c15ddabbcf888922adbdd44ca3fecf6eab19d9","versionType":"git"},{"status":"affected","version":"8d1c650d452c53fcb3f02a7b1d772741639f89a4","versionType":"git"},{"status":"affected","version":"12b5fb58ac993c24210cf8cbc72d407d3a4e6490","versionType":"git"},{"status":"affected","version":"aef37401b467a0b1a9517c69924a1d66937e0789","versionType":"git"},{"lessThan":"3.3","status":"affected","version":"3.2.99","versionType":"semver"},{"lessThan":"3.17","status":"affected","version":"3.16.54","versionType":"semver"},{"lessThan":"4.5","status":"affected","version":"4.4.225","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.225","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.182","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/l2tp/l2tp_core.c","net/l2tp/l2tp_core.h","net/l2tp/l2tp_netlink.c","net/l2tp/l2tp_ppp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.11.*","status":"unaffected","version":"6.11.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.12","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.160","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.11.3","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.99","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16.54","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.225","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.225","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.182","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: prevent possible tunnel refcount underflow\n\nWhen a session is created, it sets a backpointer to its tunnel. When\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\nrefcount if session->tunnel is non-NULL. However, session->tunnel is\nset in l2tp_session_create, before the tunnel refcount is incremented\nby l2tp_session_register, which leaves a small window where\nsession->tunnel is non-NULL when the tunnel refcount hasn't been\nbumped.\n\nMoving the assignment to l2tp_session_register is trivial but\nl2tp_session_create calls l2tp_session_set_header_len which uses\nsession->tunnel to get the tunnel's encap. Add an encap arg to\nl2tp_session_set_header_len to avoid using session->tunnel.\n\nIf l2tpv3 sessions have colliding IDs, it is possible for\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\nsession which doesn't yet have session->tunnel set. Add a check for\nthis case."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The refcount underflow is triggered by local session creation — either the L2TP generic-netlink `L2TP_CMD_SESSION_CREATE` command or a `connect()` on an `AF_PPPOX`/`PX_PROTO_OL2TP` socket. A remote peer cannot itself drive `l2tp_session_create()`/`l2tp_session_register()`, though remote packets in `l2tp_udp_encap_recv()` are what subsequently dereference the prematurely freed tunnel.\nAC:L - The attacker fully controls both sides: they choose the session ID, so they can deterministically force `l2tp_session_register()` to fail (`-EEXIST` on a colliding L2TPv3 ID, or `-ENODEV`), and they can run concurrent create/teardown threads to widen the window between `l2tp_session_create()` and the tunnel refcount bump. No condition outside attacker influence is required, and L2TP is a stock distro module.\nPR:L - `pppol2tp_create()`/`pppox_create()` perform no capability check, so a plain unprivileged local user can reach `l2tp_session_create()` and `l2tp_session_register()` through `connect()`. The netlink path is `GENL_UNS_ADMIN_PERM` (CAP_NET_ADMIN against the netns user_ns), which any unprivileged user obtains via `unshare -Urn`.\nUI:N - The attacker performs the entire sequence — tunnel setup, session creation with a colliding ID, and session teardown — from their own process. No victim action or cooperating user is involved.\nS:U - The underflow and the resulting use-after-free are confined to the kernel's own l2tp objects within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dropped-too-early tunnel reference frees `struct l2tp_tunnel` while `session->tunnel` and the datapath still reference it, giving a use-after-free on a kmalloc'd object that can be reclaimed with attacker-sprayed data and then read back (e.g. `tunnel->sock`, `tunnel->encap`, `tunnel->version` used in `l2tp_recv_common()`/`l2tp_xmit_skb()`), enabling kernel memory disclosure.\nI:H - A use-after-free on the tunnel object lets an attacker reoccupy the freed slab and control fields such as `tunnel->sock`, which the transmit and receive paths dereference and pass to socket operations, yielding a write/control-flow-hijack primitive. Additionally the extra `l2tp_tunnel_dec_refcount()` corrupts kernel reference-counting state itself.\nA:H - Premature tunnel free reliably produces an oops/panic when the still-live session or a received L2TP packet dereferences the dangling `session->tunnel`, and the `refcount_t` underflow itself raises a WARN that panics on `panic_on_warn` systems."}]}],"providerMetadata":{"dateUpdated":"2026-10-21T12:35:24.401Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/98691b2e28a6c3dac0680914493d54c77f215755"},{"url":"https://git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02"},{"url":"https://git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950"}],"title":"l2tp: prevent possible tunnel refcount underflow","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2024-49940","datePublished":"2024-10-21T18:01:59.668Z","dateReserved":"2024-10-21T12:17:06.043Z","dateUpdated":"2026-10-21T12:35:24.401Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2024-10-21 18:15:15","lastModifiedDate":"2026-10-21 13:17:49","problem_types":["NVD-CWE-noinfo"],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-10-22T13:37:52.827630Z","id":"CVE-2024-49940","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.11.3","matchCriteriaId":"6D5FF9C2-A011-4A64-B614-F9244ED2EA0D"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"49940","Ordinal":"1","Title":"l2tp: prevent possible tunnel refcount underflow","CVE":"CVE-2024-49940","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"49940","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: prevent possible tunnel refcount underflow\n\nWhen a session is created, it sets a backpointer to its tunnel. When\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\nrefcount if session->tunnel is non-NULL. However, session->tunnel is\nset in l2tp_session_create, before the tunnel refcount is incremented\nby l2tp_session_register, which leaves a small window where\nsession->tunnel is non-NULL when the tunnel refcount hasn't been\nbumped.\n\nMoving the assignment to l2tp_session_register is trivial but\nl2tp_session_create calls l2tp_session_set_header_len which uses\nsession->tunnel to get the tunnel's encap. Add an encap arg to\nl2tp_session_set_header_len to avoid using session->tunnel.\n\nIf l2tpv3 sessions have colliding IDs, it is possible for\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\nsession which doesn't yet have session->tunnel set. Add a check for\nthis case.","Type":"Description","Title":"l2tp: prevent possible tunnel refcount underflow"}]}}}