Medium 5.5Published Feb 14, 2026

CVE-2026-23120l2tp: avoid one data-race in l2tp_tunnel_del_work()

Updated under an hour ago (Oct 27, 2026, 11:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: l2tp: avoid one data-race in l2tp_tunnel_del_work() We should read sk->sk_socket only when dealing with kernel sockets. syzbot reported the following data-race: BUG: KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release write to 0xffff88811c182b20 of 8 bytes by task 5365 on cpu 0: sk_set_socket include/net/sock.h:2092 [inline] sock_orphan include/net/sock.h:2118 [inline] sk_common_release+0xae/0x230 net/core/sock.c:4003 udp_lib_close+0x15/0x20 include/net/udp.h:325 inet_release+0xce/0xf0 net/ipv4/af_inet.c:437 __sock_release net/socket.c:662 [inline] sock_close+0x6b/0x150 net/socket.c:1455 __fput+0x29b/0x650 fs/file_table.c:468 ____fput+0x1c/0x30 fs/file_table.c:496 task_work_run+0x131/0x1a0 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0x1fe/0x740 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x1e1/0x2b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff88811c182b20 of 8 bytes by task 827 on cpu 1: l2tp_tunnel_del_work+0x2f/0x1a0 net/l2tp/l2tp_core.c:1418 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340 worker_thread+0x582/0x770 kernel/workqueue.c:3421 kthread+0x489/0x510 kernel/kthread.c:463 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 value changed: 0xffff88811b818000 -> 0x0000000000000000

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-362
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d00fa9adc528c1b0e64d532556764852df8bd7b9 before 1f63ca44b4f419a1663d94d1bb0b4e2beb73fdb4; from d00fa9adc528c1b0e64d532556764852df8bd7b9 before 36c40a80109f1771d59558050b1a71e13c60c759; from d00fa9adc528c1b0e64d532556764852df8bd7b9 before eae074dab764ea181bbed5e88626889319177498; from d00fa9adc528c1b0e64d532556764852df8bd7b9 before 68e92085427c84e7679ddb53c0d68836d220b6e7; from d00fa9adc528c1b0e64d532556764852df8bd7b9 before 3d6d414b214ce31659bded2f8df50c93a3769474; from d00fa9adc528c1b0e64d532556764852df8bd7b9 before 32d417497b79efb403d75f4c185fe6fd9d64b94f; from d00fa9adc528c1b0e64d532556764852df8bd7b9 before 7a29f6bf60f2590fe5e9c4decb451e19afad2bcf; 15df699fdc5af46a9fb15ae2d9326294852de5b5; and 3 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 3.16.57 before 3.17; from 4.15.8 before 4.16; from 4.16.1 before 5.10.249; from 5.11 before 5.15.199; from 5.16 before 6.1.162; from 6.2 before 6.6.122; from 6.7 before 6.12.68; from 6.13 before 6.18.8; and 10 more ranges	NVD

References

References

https://git.kernel.org/stable/c/1f63ca44b4f419a1663d94d1bb0b4e2beb73fdb4	patch
https://git.kernel.org/stable/c/36c40a80109f1771d59558050b1a71e13c60c759	patch
https://git.kernel.org/stable/c/eae074dab764ea181bbed5e88626889319177498	patch
https://git.kernel.org/stable/c/68e92085427c84e7679ddb53c0d68836d220b6e7	patch
https://git.kernel.org/stable/c/3d6d414b214ce31659bded2f8df50c93a3769474	patch
https://git.kernel.org/stable/c/32d417497b79efb403d75f4c185fe6fd9d64b94f	patch
https://git.kernel.org/stable/c/7a29f6bf60f2590fe5e9c4decb451e19afad2bcf	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.