CVE-2026-74735

A flaw was found in the Linux kernel's L2TP (Layer 2 Tunneling Protocol) implementation. A local user could trigger a reference count leak by closing specific /proc or /sys files related to L2TP tunnels and sessions before fully reading their content. This could lead to resource exhaustion, potentially causing a Denial of Service (DoS) condition on the system.

A moderate-severity reference count leak was found in the Linux kernel's L2TP (Layer 2 Tunneling Protocol) implementation. When /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels is opened, iteration state holding tunnel and session references is stored in seq_file private data so that listing can continue across multiple read() system calls. If a local user closes one of these files before reading to end-of-file (EOF), the outstanding tunnel and session references stored in the private data are never dropped when that data is freed. Repeatedly opening and closing these files before EOF can therefore keep L2TP tunnel and session objects alive indefinitely, leading to kernel resource exhaustion and preventing normal cleanup of sessions, tunnels, or network namespaces, which can result in a local denial of service. Red Hat scored this flaw with a CVSS:3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting that exploitation requires local access and low privileges and impacts availability only. The Red Hat Enterprise Linux 8, 9, and 10 kernel and kernel-rt packages and the Red Hat In-Vehicle OS 2 kernels are affected; fixes for these streams are currently deferred, and the residual risk is limited to local denial of service, as the flaw does not impact confidentiality or integrity. Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support (kernel and kernel-rt) are not affected because the vulnerable code is not present in those releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.