CVE-2024-49940High· 7.8▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: l2tp: prevent possible tunnel refcount underflow When a session is created, it sets a backpointer to its tunnel. When the session refcount drops to 0, l2tp_session_fre…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
0.2% → 0.3%
In the Linux kernel, the following vulnerability has been resolved:
l2tp: prevent possible tunnel refcount underflow
When a session is created, it sets a backpointer to its tunnel. When the session refcount drops to 0, l2tp_session_free drops the tunnel refcount if session->tunnel is non-NULL. However, session->tunnel is set in l2tp_session_create, before the tunnel refcount is incremented by l2tp_session_register, which leaves a small window where session->tunnel is non-NULL when the tunnel refcount hasn't been bumped.
Moving the assignment to l2tp_session_register is trivial but l2tp_session_create calls l2tp_session_set_header_len which uses session->tunnel to get the tunnel's encap. Add an encap arg to l2tp_session_set_header_len to avoid using session->tunnel.
If l2tpv3 sessions have colliding IDs, it is possible for l2tp_v3_session_get to race with l2tp_session_register and fetch a session which doesn't yet have session->tunnel set. Add a check for this case.
Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c < 98691b2e28a6c3dac0680914493d54c77f215755Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c < f7415e60c25a6108cd7955a20b2e66b6251ffe02Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c < 24256415d18695b46da06c93135f5b51c548b950Linux b102bfc2a90d14f342580285782a9a51c74f7369Linux 10c15ddabbcf888922adbdd44ca3fecf6eab19d9Linux 8d1c650d452c53fcb3f02a7b1d772741639f89a4Linux 12b5fb58ac993c24210cf8cbc72d407d3a4e6490Linux aef37401b467a0b1a9517c69924a1d66937e0789Linux >= 3.2.99 < 3.3Linux >= 3.16.54 < 3.17Linux >= 4.4.225 < 4.5Linux >= 4.9.225 < 4.10Linux >= 4.14.182 < 4.15Linux 4.15Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance
CVE-2026-99120NoneKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
CVE-2026-99119Nonedrm/amdgpu/userq: actually validate userq BOs
CVE-2026-99123Nonevsock/virtio: validate packet source for connected sockets