CVE-2026-23120

A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP) implementation. A local user can exploit a data-race condition during L2TP tunnel deletion. This occurs when the l2tp_tunnel_del_work function attempts to read socket information without proper synchronization while the underlying socket is concurrently closed. Successfully exploiting this timing window can lead to a kernel crash or system hang, resulting in a Denial of Service (DoS).

A race exists in the L2TP tunnel deletion workqueue path where l2tp_tunnel_del_work read sk->sk_socket without synchronization while another task could concurrently orphan and close the underlying socket. KCSAN reports a data race where sk_socket changes from a valid pointer to NULL during the work execution. This is primarily a stability issue that can lead to incorrect behavior and potentially a kernel crash or hang depending on timing and follow on code paths. For the CVSS the PR is L because a local user can create and close sockets and can trigger L2TP teardown operations through normal interfaces. The attack complexity is high because it requires winning a narrow timing window between socket close and the deferred tunnel deletion work. Impact is mainly availability due to potential kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.