{"id":"CVE-2024-49940","title":"l2tp: prevent possible tunnel refcount underflow","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: prevent possible tunnel refcount underflow\n\nWhen a session is created, it sets a backpointer to its tunnel. When\nthe session refcount drops to 0, l2tp_session_fre…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c < 98691b2e28a6c3dac0680914493d54c77f215755","Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c < f7415e60c25a6108cd7955a20b2e66b6251ffe02","Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c < 24256415d18695b46da06c93135f5b51c548b950","Linux b102bfc2a90d14f342580285782a9a51c74f7369","Linux 10c15ddabbcf888922adbdd44ca3fecf6eab19d9","Linux 8d1c650d452c53fcb3f02a7b1d772741639f89a4","Linux 12b5fb58ac993c24210cf8cbc72d407d3a4e6490","Linux aef37401b467a0b1a9517c69924a1d66937e0789","Linux >= 3.2.99 < 3.3","Linux >= 3.16.54 < 3.17","Linux >= 4.4.225 < 4.5","Linux >= 4.9.225 < 4.10","Linux >= 4.14.182 < 4.15","Linux 4.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-10-22T13:37:52.827630Z"},"published":"2024-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:35:24.401Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-49940","references":[{"url":"https://git.kernel.org/stable/c/98691b2e28a6c3dac0680914493d54c77f215755"},{"url":"https://git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02"},{"url":"https://git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950"}],"tags":["cve.org"],"epss":0.00325,"epssPercentile":0.25378,"ingestedAt":"2026-10-21T12:48:53.727Z","slug":"CVE-2024-49940","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: prevent possible tunnel refcount underflow\n\nWhen a session is created, it sets a backpointer to its tunnel. When\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\nrefcount if session->tunnel is non-NULL. However, session->tunnel is\nset in l2tp_session_create, before the tunnel refcount is incremented\nby l2tp_session_register, which leaves a small window where\nsession->tunnel is non-NULL when the tunnel refcount hasn't been\nbumped.\n\nMoving the assignment to l2tp_session_register is trivial but\nl2tp_session_create calls l2tp_session_set_header_len which uses\nsession->tunnel to get the tunnel's encap. Add an encap arg to\nl2tp_session_set_header_len to avoid using session->tunnel.\n\nIf l2tpv3 sessions have colliding IDs, it is possible for\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\nsession which doesn't yet have session->tunnel set. Add a check for\nthis case.\n\n## Affected\n\n- `Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c < 98691b2e28a6c3dac0680914493d54c77f215755`\n- `Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c < f7415e60c25a6108cd7955a20b2e66b6251ffe02`\n- `Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c < 24256415d18695b46da06c93135f5b51c548b950`\n- `Linux b102bfc2a90d14f342580285782a9a51c74f7369`\n- `Linux 10c15ddabbcf888922adbdd44ca3fecf6eab19d9`\n- `Linux 8d1c650d452c53fcb3f02a7b1d772741639f89a4`\n- `Linux 12b5fb58ac993c24210cf8cbc72d407d3a4e6490`\n- `Linux aef37401b467a0b1a9517c69924a1d66937e0789`\n- `Linux >= 3.2.99 < 3.3`\n- `Linux >= 3.16.54 < 3.17`\n- `Linux >= 4.4.225 < 4.5`\n- `Linux >= 4.9.225 < 4.10`\n- `Linux >= 4.14.182 < 4.15`\n- `Linux 4.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}