CVE-2026-23072

l2tp: Fix memleak in l2tp_udp_encap_recv().

published February 4, 2026

CVSS
—
EPSS
0%
Percentile
3.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

l2tp: Fix memleak in l2tp_udp_encap_recv().

syzbot reported memleak of struct l2tp_session, l2tp_tunnel,

sock, etc. [0]

The cited commit moved down the validation of the protocol

version in l2tp_udp_encap_recv().

The new place requires an extra error handling to avoid the

memleak.

Let's call l2tp_session_put() there.

[0]:

BUG: memory leak

unreferenced object 0xffff88810a290200 (size 512):

comm "syz.0.17", pid 6086, jiffies 4294944299

hex dump (first 32 bytes):

7d eb 04 0c 00 00 00 00 01 00 00 00 00 00 00 00 }...............

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

backtrace (crc babb6a4f):

kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]

slab_post_alloc_hook mm/slub.c:4958 [inline]

slab_alloc_node mm/slub.c:5263 [inline]

__do_kmalloc_node mm/slub.c:5656 [inline]

__kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669

kmalloc_noprof include/linux/slab.h:961 [inline]

kzalloc_noprof include/linux/slab.h:1094 [inline]

l2tp_session_create+0x3a/0x3b0 net/l2tp/l2tp_core.c:1778

pppol2tp_connect+0x48b/0x920 net/l2tp/l2tp_ppp.c:755

__sys_connect_file+0x7a/0xb0 net/socket.c:2089

__sys_connect+0xde/0x110 net/socket.c:2108

__do_sys_connect net/socket.c:2114 [inline]

__se_sys_connect net/socket.c:2111 [inline]

__x64_sys_connect+0x1c/0x30 net/socket.c:2111

do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]

do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94

entry_SYSCALL_64_after_hwframe+0x77/0x7f

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00141 · 3.1th percentile
Published
2026-02-04T16:07Z
EPSS history
Timeline
  • 04 FEB 16:07Z
    l2tp: Fix memleak in l2tp_udp_encap_recv().
    cvelistv5