CVE-2026-63918

A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (l2tp) module. A race condition exists where a network session's memory could be prematurely released while still in use. This vulnerability, caused by incorrect reference counting, may allow a local attacker to trigger a system crash (denial of service) or potentially execute unauthorized code.

This vulnerability is rated as Moderate impact because triggering the race condition requires local authenticated access and narrow timing during concurrent tunnel session destruction and lookup. Under typical Red Hat Enterprise Linux configurations, the L2TP networking facility is not loaded by default and is only utilized when Layer 2 tunneling protocols are explicitly configured. Additionally, the problematic code path was introduced in newer upstream kernels, leaving RHEL 8 and RHEL 9 unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.