CVE-2026-23072: l2tp: Fix memleak in l2tp_udp_encap_recv().
In the Linux kernel, the following vulnerability has been resolved:
l2tp: Fix memleak in l2tpudpencaprecv().
syzbot reported memleak of struct l2tpsession, l2tptunnel, sock, etc. [0]
The cited commit moved down the validation of the protocol version in l2tpudpencaprecv().
The new place requires an extra error handling to avoid the memleak.
Let's call l2tpsessionput() there.
[0]: BUG: memory leak unreferenced object 0xffff88810a290200 (size 512): comm "syz.0.17", pid 6086, jiffies 4294944299 hex dump (first 32 bytes): 7d eb 04 0c 00 00 00 00 01 00 00 00 00 00 00 00 }............... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc babb6a4f): kmemleakallocrecursive include/linux/kmemleak.h:44 [inline] slabpostallochook mm/slub.c:4958 [inline] slaballocnode mm/slub.c:5263 [inline] dokmallocnode mm/slub.c:5656 [inline] kmallocnoprof+0x3e0/0x660 mm/slub.c:5669 kmallocnoprof include/linux/slab.h:961 [inline] kzallocnoprof include/linux/slab.h:1094 [inline] l2tpsessioncreate+0x3a/0x3b0 net/l2tp/l2tpcore.c:1778 pppol2tpconnect+0x48b/0x920 net/l2tp/l2tpppp.c:755 sysconnectfile+0x7a/0xb0 net/socket.c:2089 sysconnect+0xde/0x110 net/socket.c:2108 dosysconnect net/socket.c:2114 [inline] sesysconnect net/socket.c:2111 [inline] x64sysconnect+0x1c/0x30 net/socket.c:2111 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xa4/0xf80 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In l2tp_udp_encap_recv(), call l2tp_session_put() on the error path after protocol-version validation to release the l2tp_session and prevent the memory leak.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23072?
CVE-2026-23072 is classified as a moderate severity vulnerability due to the potential for resource leakage affecting system performance.
How do I fix CVE-2026-23072?
To fix CVE-2026-23072, users should update their Linux kernel to the latest stable version that includes the patch for the memory leak.
Which versions of the Linux Kernel are affected by CVE-2026-23072?
CVE-2026-23072 affects multiple versions of the Linux Kernel prior to the application of the relevant patches.
What exploit mitigation is necessary for CVE-2026-23072?
While there is no specific exploit for CVE-2026-23072, it's advisable to apply patches promptly to mitigate potential memory leaks.
Can CVE-2026-23072 lead to a denial of service?
Yes, CVE-2026-23072 could potentially lead to a denial of service due to excessive memory consumption if left unaddressed.