CVE-2026-63918: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63918 Overview

CVE-2026-63918 is a use-after-free vulnerability in the Linux kernel's Layer 2 Tunneling Protocol (L2TP) subsystem. The flaw resides in the l2tp_session_get_by_ifname() function within net/l2tp/. A reader can obtain a pointer to an L2TP session whose reference count has already reached zero, because the getter uses refcount_inc() instead of refcount_inc_not_zero(). Every other session getter in the same file already uses the safe pattern, making this function the only outlier. Exploitation can lead to a slab-use-after-free when the RCU grace period closes and kfree_rcu() frees the session memory.

Critical Impact
A local attacker triggering the race window during L2TP session teardown can cause kernel memory corruption, leading to denial of service or potential local privilege escalation.

Affected Products

Linux Kernel (upstream) — versions prior to the fix commits
Linux Kernel stable branches receiving backports via commits 05f95729ca84, 782d60a6596a, 947013fd7c8c, and ee80455feffb
Distributions shipping vulnerable kernels with L2TP support enabled

Discovery Timeline

2026-07-19 - CVE-2026-63918 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63918

Vulnerability Analysis

The vulnerability is a race condition leading to a use-after-free in the L2TP session lookup path. l2tp_session_get_by_ifname() walks the session list under rcu_read_lock_bh() and, on a name match, acquires a reference with a plain refcount_inc(). Concurrent teardown on another CPU can invoke refcount_dec_and_test(), driving the reference count to zero and scheduling l2tp_session_free() followed by kfree_rcu().

If the reader is preempted between the strcmp() on session->ifname and the refcount_inc(), the counter can already be zero when the reader increments it. The kernel's refcount_t API detects the addition-on-zero condition, emits the refcount_t: addition on 0; use-after-free warning, and saturates the counter. However, the caller still receives the saturated pointer and may dereference the session after the RCU grace period expires and its memory is freed.

Root Cause

The root cause is API inconsistency within net/l2tp/. The sibling getters l2tp_v2_session_get(), l2tp_v3_session_get(), and their _get_next variants correctly use refcount_inc_not_zero() to defend against races with refcount_dec_and_test(). The l2tp_session_get_by_ifname() function retained the unsafe refcount_inc() pattern, breaking the invariant that IDR/RCU lookups can race with reference-count-driven frees. The issue was highlighted after commit 979c017803c4 ("l2tp: use list_del_rcu in l2tp_session_unhash").

Attack Vector

Exploitation requires local access with the ability to create, look up, and tear down L2TP sessions. On PREEMPT_RT kernels the preemption window is real because local_bh_disable() is a per-CPU sleeping lock. On stock PREEMPT kernels the window is much narrower but still theoretically reachable through carefully timed session churn. Successful races produce kernel memory corruption that can be leveraged for denial of service or local privilege escalation.

No verified public proof-of-concept code is available. The vulnerability is described in prose in the upstream commit messages; refer to the Linux Kernel Commit for the authoritative fix description.

Detection Methods for CVE-2026-63918

Indicators of Compromise

Kernel log messages containing refcount_t: addition on 0; use-after-free originating from the L2TP subsystem stack trace.
Kernel panics or KASAN: slab-use-after-free reports referencing l2tp_session_get_by_ifname or l2tp_session_free.
Unexpected L2TP tunnel or session teardown events correlated with anomalous process activity on the host.

Detection Strategies

Monitor dmesg and /var/log/kern.log for refcount_t warnings and KASAN reports tied to net/l2tp/ symbols.
Deploy eBPF tracepoints on l2tp_session_free and l2tp_session_get_by_ifname to observe abnormal call frequency or concurrent execution patterns.
Alert on unprivileged users invoking ioctl or netlink operations that create or destroy L2TP sessions in rapid succession.

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and create detections for refcount_t and use-after-free string matches.
Track kernel version inventory across Linux hosts and flag systems running unpatched builds with L2TP compiled in.
Correlate kernel crash telemetry with process ancestry to identify the actor triggering L2TP teardown paths.

How to Mitigate CVE-2026-63918

Immediate Actions Required

Apply the upstream fix commits (05f95729ca84, 782d60a6596a, 947013fd7c8c, ee80455feffb) or update to a distribution kernel that includes them.
Audit hosts for the presence of the l2tp_netlink and l2tp_core modules and unload them where L2TP is not required.
Restrict CAP_NET_ADMIN and namespace creation privileges to reduce the population of users who can manipulate L2TP sessions.

Patch Information

The fix replaces the bare refcount_inc() in l2tp_session_get_by_ifname() with refcount_inc_not_zero() and continues the list walk on failure, restoring parity with the other session getters. Patched commits are available at kernel.org 05f95729, kernel.org 782d60a6, kernel.org 947013fd, and kernel.org ee80455f.

Workarounds

Blacklist the l2tp_core, l2tp_netlink, l2tp_ppp, and l2tp_eth kernel modules on systems that do not require L2TP tunneling.
Deny unprivileged user namespace creation via sysctl kernel.unprivileged_userns_clone=0 to limit local attackers reaching the L2TP netlink API.
Constrain access to L2TP configuration tools through mandatory access control policies such as SELinux or AppArmor until patches are deployed.

bash

# Configuration example - disable L2TP modules where unused
echo 'install l2tp_core /bin/true' | sudo tee /etc/modprobe.d/blacklist-l2tp.conf
echo 'install l2tp_netlink /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-l2tp.conf
echo 'install l2tp_ppp /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-l2tp.conf
echo 'install l2tp_eth /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-l2tp.conf
sudo update-initramfs -u

# Verify patched kernel version
uname -r