UBUNTU-CVE-2026-74735: Medium severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: l2tp: fix tunnel and session refcount leak on seqfile release In pppol2tpprocopen() and l2tpdfsseqopen(), iteration state (pd->tunnel and pd->session) is kept in seqfile private data to allow iteration across multiple read() system calls. However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reading to end-of-file (EOF), any tunnel or session reference stored in pd->tunnel / pd->session is left un-dropped when seqfile private data is freed. Fix this by dropping any remaining pd->tunnel and pd->session references in pppol2tpprocrelease() and l2tpdfsseqrelease() when closing the file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In pppol2tp_proc_release() and l2tp_dfs_seq_release(), drop any remaining pd->tunnel and pd->session references when the file is closed, including when /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels is closed before EOF.
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
The vulnerability is locally exploitable and requires low-level privileges. Exploitation involves opening the affected L2TP procfs or debugfs file and closing it before reading it to EOF.
Which Ubuntu systems are in scope?
The affected software list includes Ubuntu linux, linux-azure, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux-gcp, and linux-oracle kernel packages. The provided data does not identify specific affected or fixed package versions.
What is the likely security impact?
The issue leaks L2TP tunnel and session references when the relevant files are closed early. The supplied severity vector rates the availability impact as high, while confidentiality and integrity impacts are rated as none.