CVE-2026-23072: Linux Kernel Memory Leak Vulnerability

CVE-2026-23072 Overview

CVE-2026-23072 is a memory leak vulnerability in the Linux kernel's Layer 2 Tunneling Protocol (L2TP) subsystem. The flaw resides in the l2tp_udp_encap_recv() function in net/l2tp/l2tp_core.c. A prior commit relocated the protocol version validation, introducing a code path that fails to release l2tp_session references when validation rejects a packet. Local attackers can repeatedly trigger the leak to exhaust kernel memory and cause denial of service. The issue was reported by syzbot and is tracked under [CWE-401]. Affected versions include Linux kernel 6.19 release candidates rc1 through rc6.

Critical Impact
Local users can exhaust kernel memory by triggering repeated allocations of struct l2tp_session, l2tp_tunnel, and sock objects that are never freed, leading to system-wide denial of service.

Affected Products

Linux Kernel 6.19-rc1
Linux Kernel 6.19-rc2 through 6.19-rc5
Linux Kernel 6.19-rc6

Discovery Timeline

2026-02-04 - CVE-2026-23072 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23072

Vulnerability Analysis

The vulnerability exists in the L2TP UDP encapsulation receive handler, l2tp_udp_encap_recv(). A previous commit moved the L2TP protocol version validation check to a later point in the function. After this reordering, the function acquires a reference to an l2tp_session object before validating the protocol version. When validation fails and the function returns early, the session reference is never released. Each rejected packet leaks a struct l2tp_session along with associated l2tp_tunnel and sock allocations. The fix calls l2tp_session_put() on the error path to balance the reference count.

Root Cause

The root cause is a missing reference release on an error handling path, classified as [CWE-401] Missing Release of Memory after Effective Lifetime. The kmemleak trace shows allocations originating in l2tp_session_create() at net/l2tp/l2tp_core.c:1778, reached through pppol2tp_connect() in net/l2tp/l2tp_ppp.c. Once execution returns from l2tp_udp_encap_recv() without releasing the session, the kernel allocator retains the 512-byte object indefinitely.

Attack Vector

Exploitation requires local access and the ability to send UDP packets to an L2TP socket. A user with CAP_NET_ADMIN or an unprivileged process able to interact with an L2TP endpoint can craft packets with invalid protocol version fields. Each invalid packet processed through l2tp_udp_encap_recv() leaks kernel memory. Sustained delivery exhausts kernel slab memory and degrades or halts the system. The attack does not yield code execution or information disclosure, but it impacts availability.

No verified exploit code is publicly available. The vulnerability mechanism is described in the upstream commit logs referenced below.

Detection Methods for CVE-2026-23072

Indicators of Compromise

Steady growth in kmalloc-512 slab usage reported by /proc/slabinfo without a corresponding workload increase.
Kmemleak reports referencing l2tp_session_create+0x3a/0x3b0 in the allocation backtrace.
Unexplained Out of memory events on hosts running L2TP/PPP tunnels.

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test kernels and inspect /sys/kernel/debug/kmemleak for L2TP-related unreferenced objects.
Compare running kernel versions against the patched commits 4d10edfd1475, 5cd158a88eef, and d4ce79e6dce2 published in kernel.org stable trees.
Audit hosts for unexpected pppol2tp socket creation through process accounting or audit rules on the connect syscall.

Monitoring Recommendations

Monitor kernel slab consumption trends and alert on sustained growth in sock_inode_cache and L2TP-related caches.
Track dmesg output for memory pressure warnings and OOM killer activity on L2TP-bearing hosts.
Log creation of L2TP tunnels and sessions through netlink audit subscriptions where supported.

How to Mitigate CVE-2026-23072

Immediate Actions Required

Apply the upstream patches from the Linux stable tree once available from your distribution maintainer.
Restrict access to L2TP socket creation by limiting CAP_NET_ADMIN on multi-tenant hosts.
Unload the l2tp_ppp and l2tp_core kernel modules on systems that do not require L2TP functionality.

Patch Information

The fix adds a call to l2tp_session_put() in the error handling path of l2tp_udp_encap_recv(). The patches are committed to the mainline and stable kernel trees as 4d10edfd1475, 5cd158a88eef, and d4ce79e6dce2. Affected systems should upgrade to a kernel release incorporating these commits.

Workarounds

Blacklist the l2tp_ppp and pppol2tp modules where L2TP is not in use by adding entries to /etc/modprobe.d/.
Apply namespace and seccomp restrictions to prevent untrusted workloads from creating L2TP sockets.
Configure memory cgroups to bound kernel slab usage per workload and contain the impact of leaked allocations.

bash

# Configuration example: blacklist L2TP modules on hosts that do not require them
echo "blacklist l2tp_ppp" | sudo tee /etc/modprobe.d/disable-l2tp.conf
echo "blacklist l2tp_core" | sudo tee -a /etc/modprobe.d/disable-l2tp.conf
sudo update-initramfs -u