CVE-2026-64119 Linux CVE debrief

Who should care

Users of Linux kernel versions affected by this vulnerability should review and apply patches to prevent potential denial-of-service attacks. This includes administrators and security teams responsible for maintaining Linux-based systems, especially those using the l2tp_core module. They should assess their exposure, apply patches or mitigations, and monitor system logs for potential exploitation attempts.

Technical summary

The Linux kernel vulnerability CVE-2026-64119 involves a use-after-free issue in the l2tp_session_unhash function. An unprivileged local user can cause a host CPU to be indefinitely pinned by issuing specific L2TP commands concurrently. The vulnerability is due to the use of list_del_init in l2tp_session_unhash, which leaves the deleted entry's next/prev pointers self-pointing. This causes list_for_each_entry_rcu to loop indefinitely, preventing the deleted session from being properly removed. The fix involves changing list_del_init to list_del_rcu to match the existing list_add_rcu in l2tp_session_register.

Defensive priority

High priority should be given to patching this vulnerability, as it can be exploited by an unprivileged local user to cause a denial-of-service attack.

Recommended defensive actions

• Apply the official patch from the Linux kernel maintainers.
• Review and update Linux kernel versions to ensure the patched version is deployed.
• Monitor system logs for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was resolved by changing list_del_init to list_del_rcu in l2tp_session_unhash. This change ensures that the deleted session remains visible to in-flight walkers with consistent next/prev pointers until kfree_rcu releases it. The fix has no userspace-visible behavior change. The vulnerability affects Linux kernel versions and can be exploited by an unprivileged local user to cause a denial-of-service attack.

Official resources