CVE-2026-23072

A memory leak vulnerability was found in the Linux kernel's L2TP (Layer 2 Tunneling Protocol) implementation. After a code refactoring that moved protocol version validation in l2tp_udp_encap_recv(), the error handling path fails to call l2tp_session_put() to release the session reference. This causes l2tp_session, l2tp_tunnel, and associated socket structures to leak on each failed validation.

This memory leak was discovered by syzkaller and affects systems using L2TP tunneling. Repeated triggering of the error path through malformed L2TP packets can gradually exhaust kernel memory, leading to denial of service. The leak requires the ability to send L2TP traffic to the affected system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the l2tp_core module from being loaded if L2TP tunneling is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.