CVE-2026-53262

In the Linux kernel, the following vulnerability has been resolved:

l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()

pppol2tp_ioctl() read sock->sk->sk_user_data directly without any

locks or reference counting. If a controllable sleep was induced during

copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent

socket close could trigger pppol2tp_session_close() asynchronously. This

frees the l2tp_session structure via the l2tp_session_del_work workqueue.

Upon resuming, the ioctl thread dereferences the stale session pointer,

resulting in a Use-After-Free (UAF).

Fix this by securely fetching the session reference using the RCU-safe,

refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the

session's refcount across the sleep. We structured the function to exit

via standard err breaks, guaranteeing that l2tp_session_put() is cleanly

called on all return paths to drop the reference.

To preserve existing behavior we validate the session and its magic

signature only for the specific L2TP commands that require it. This

ensures that generic/unknown ioctls called on an unconnected socket

still return -ENOIOCTLCMD and correctly fall back to generic handlers

(e.g. in sock_do_ioctl()).