UBUNTU-CVE-2026-80996: Medium severity ubuntu/linux-aws vulnerability
In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encoding a message, or while multicasting it. For tunnel and session create/modify, a notification is sent after the live operation has completed. Returning a best-effort notification error as the command result can therefore report failure for an operation that already committed and can cause callers to retry and accumulate live objects. Keep sending notifications for listener visibility, but do not propagate their best-effort status as the command result. This also keeps the tunnel modify command consistent with the other notification-only paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using the affected Ubuntu Linux kernel packages are relevant when they use L2TP netlink tunnel or session create or modify operations. The listed packages include linux, linux-aws, linux-azure, linux-gcp, and their listed FIPS variants.
What does an attacker or triggering process need to do?
The triggering party needs local access and low privileges, as reflected by the AV:L and PR:L vector. It must issue L2TP netlink tunnel or session create or modify requests and encounter a failure while the kernel sends the associated multicast notification.
What is the practical impact?
A completed L2TP tunnel or session operation can be reported as failed when only its post-operation multicast notification failed. Callers may retry based on that error and accumulate live tunnel or session objects, affecting availability.
How can I tell whether this has occurred?
Look for L2TP create or modify commands that returned an error despite the corresponding tunnel or session having been created or modified. Repeated retries paired with unexpectedly accumulating live L2TP objects are an indicator.
What can be done before a fix is available?
Avoid blindly retrying failed L2TP tunnel or session create or modify requests without first checking whether the requested object already exists or was updated. Treat errors from these operations cautiously because the live operation may already have committed.