---
id: CVE-2024-49940
title: 'l2tp: prevent possible tunnel refcount underflow'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  l2tp: prevent possible tunnel refcount underflow

  When a session is created, it sets a backpointer to its tunnel. When
  the session refcount drops to 0, l2tp_session_fre…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c <
    98691b2e28a6c3dac0680914493d54c77f215755
  - >-
    Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c <
    f7415e60c25a6108cd7955a20b2e66b6251ffe02
  - >-
    Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c <
    24256415d18695b46da06c93135f5b51c548b950
  - Linux b102bfc2a90d14f342580285782a9a51c74f7369
  - Linux 10c15ddabbcf888922adbdd44ca3fecf6eab19d9
  - Linux 8d1c650d452c53fcb3f02a7b1d772741639f89a4
  - Linux 12b5fb58ac993c24210cf8cbc72d407d3a4e6490
  - Linux aef37401b467a0b1a9517c69924a1d66937e0789
  - Linux >= 3.2.99 < 3.3
  - Linux >= 3.16.54 < 3.17
  - Linux >= 4.4.225 < 4.5
  - Linux >= 4.9.225 < 4.10
  - Linux >= 4.14.182 < 4.15
  - Linux 4.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-10-22T13:37:52.827630Z'
published: '2024-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:35:24.401Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-49940'
references:
  - url: 'https://git.kernel.org/stable/c/98691b2e28a6c3dac0680914493d54c77f215755'
  - url: 'https://git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02'
  - url: 'https://git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950'
tags:
  - cve.org
epss: 0.00325
epssPercentile: 0.25378
ingestedAt: '2026-10-21T12:48:53.727Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

l2tp: prevent possible tunnel refcount underflow

When a session is created, it sets a backpointer to its tunnel. When
the session refcount drops to 0, l2tp_session_free drops the tunnel
refcount if session->tunnel is non-NULL. However, session->tunnel is
set in l2tp_session_create, before the tunnel refcount is incremented
by l2tp_session_register, which leaves a small window where
session->tunnel is non-NULL when the tunnel refcount hasn't been
bumped.

Moving the assignment to l2tp_session_register is trivial but
l2tp_session_create calls l2tp_session_set_header_len which uses
session->tunnel to get the tunnel's encap. Add an encap arg to
l2tp_session_set_header_len to avoid using session->tunnel.

If l2tpv3 sessions have colliding IDs, it is possible for
l2tp_v3_session_get to race with l2tp_session_register and fetch a
session which doesn't yet have session->tunnel set. Add a check for
this case.

## Affected

- `Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c < 98691b2e28a6c3dac0680914493d54c77f215755`
- `Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c < f7415e60c25a6108cd7955a20b2e66b6251ffe02`
- `Linux >= 3953ae7b218df4d1e544b98a393666f9ae58a78c < 24256415d18695b46da06c93135f5b51c548b950`
- `Linux b102bfc2a90d14f342580285782a9a51c74f7369`
- `Linux 10c15ddabbcf888922adbdd44ca3fecf6eab19d9`
- `Linux 8d1c650d452c53fcb3f02a7b1d772741639f89a4`
- `Linux 12b5fb58ac993c24210cf8cbc72d407d3a4e6490`
- `Linux aef37401b467a0b1a9517c69924a1d66937e0789`
- `Linux >= 3.2.99 < 3.3`
- `Linux >= 3.16.54 < 3.17`
- `Linux >= 4.4.225 < 4.5`
- `Linux >= 4.9.225 < 4.10`
- `Linux >= 4.14.182 < 4.15`
- `Linux 4.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.