CVE-2026-53262

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()

pppol2tp_ioctl() read sock->sk->sk_user_data directly without any

locks or reference counting. If a controllable sleep was induced during

copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent

socket close could trigger pppol2tp_session_close() asynchronously. This

frees the l2tp_session structure via the l2tp_session_del_work workqueue.

Upon resuming, the ioctl thread dereferences the stale session pointer,

resulting in a Use-After-Free (UAF).

Fix this by securely fetching the session reference using the RCU-safe,

refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the

session's refcount across the sleep. We structured the function to exit

via standard err breaks, guaranteeing that l2tp_session_put() is cleanly

called on all return paths to drop the reference.

To preserve existing behavior we validate the session an

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References