CVE-2026-80996

A flaw was found in the Linux kernel's L2TP (Layer 2 Tunneling Protocol) networking component. Specifically, the netlink handlers responsible for creating and modifying L2TP tunnels and sessions may fail to propagate multicast notification errors. This can lead to calling applications retrying operations that have already successfully completed, potentially causing an accumulation of live objects. Such an accumulation could result in resource exhaustion, leading to a denial of service.

A low-impact flaw was found in the Linux kernel's L2TP (Layer 2 Tunneling Protocol) netlink handling. The netlink handlers for tunnel create, tunnel modify, session create, and session modify send a multicast notification after the requested operation has already been committed, and an error encountered while allocating, encoding, or multicasting that notification was incorrectly propagated as the result of the command. A local attacker with the privileges required to issue L2TP netlink commands could exploit this behavior so that a calling application receives a failure for an operation that actually succeeded; if the application retries the command, live L2TP tunnel and session objects accumulate in the kernel, which can lead to resource exhaustion and a denial of service. Only availability is affected; there is no impact on confidentiality or integrity. The kernel shipped in Red Hat Enterprise Linux 8 and 9, Red Hat In-Vehicle OS, and the RHEL CoreOS kernel shipped with OpenShift Container Platform 4 is affected. Red Hat Enterprise Linux 6 and 7 Extended Life Cycle Support are not affected because the vulnerable code is not present in those kernels. The fix is currently deferred for the affected products because this flaw is rated low impact and does not meet the bar for an urgent security update; the residual risk is a local denial of service by an already-privileged local user. Although the CVSS:3.1 score of 5.5 reflects the high availability impact, the low impact rating takes into account that exploitation requires local access with the privileges needed to perform L2TP netlink operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.