CVE-2026-63918

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname

A reader in l2tp_session_get_by_ifname() can return a pointer to a

session whose refcount has reached zero. The getter takes its

reference with plain refcount_inc(), but every other session getter

in the same file (l2tp_v2_session_get, l2tp_v3_session_get, and the

corresponding _get_next variants) uses refcount_inc_not_zero()

because the IDR/RCU lookup can race with refcount_dec_and_test() ->

l2tp_session_free() -> kfree_rcu(). The ifname getter is the only

outlier; the inconsistency was raised on-list after 979c017803c4

("l2tp: use list_del_rcu in l2tp_session_unhash").

A reader inside rcu_read_lock_bh() that matches session->ifname can

be preempted between the strcmp() and the refcount_inc(). If the

last reference drops on another CPU in that window, the reader's

refcount_inc() runs on a counter that has reached zero. refcount_t

catches the addition-on-

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References