CVE-2026-23120

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

l2tp: avoid one data-race in l2tp_tunnel_del_work()

We should read sk->sk_socket only when dealing with kernel sockets.

syzbot reported the following data-race:

BUG: KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release

write to 0xffff88811c182b20 of 8 bytes by task 5365 on cpu 0:

sk_set_socket include/net/sock.h:2092 [inline]

sock_orphan include/net/sock.h:2118 [inline]

sk_common_release+0xae/0x230 net/core/sock.c:4003

udp_lib_close+0x15/0x20 include/net/udp.h:325

inet_release+0xce/0xf0 net/ipv4/af_inet.c:437

__sock_release net/socket.c:662 [inline]

sock_close+0x6b/0x150 net/socket.c:1455

__fput+0x29b/0x650 fs/file_table.c:468

____fput+0x1c/0x30 fs/file_table.c:496

task_work_run+0x131/0x1a0 kernel/task_work.c:233

resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]

__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]

exit_to_user_mode_loop+0x1fe/0x740 kernel/en

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References