CVE-2026-64119: Linux Kernel Race Condition Vulnerability

CVE-2026-64119 Overview

CVE-2026-64119 is a denial-of-service vulnerability in the Linux kernel's Layer 2 Tunneling Protocol (L2TP) subsystem. The flaw resides in l2tp_session_unhash(), which incorrectly uses list_del_init() instead of list_del_rcu() when removing a session from tunnel->session_list. An unprivileged local user can pin a host CPU indefinitely by racing L2TP_CMD_SESSION_GET against concurrent L2TP_CMD_SESSION_CREATE and L2TP_CMD_SESSION_DELETE commands on the same tunnel. The trigger is reachable from an unprivileged user namespace on any host that has the l2tp_core module loaded.

Critical Impact
An unprivileged local user in a user namespace sandbox can wedge a host CPU, stall RCU grace periods system-wide, and produce an unkillable kernel thread.

Affected Products

Linux kernel versions containing the vulnerable l2tp_session_unhash() implementation
Systems with the l2tp_core kernel module loaded or auto-loadable
Distributions permitting unprivileged user namespaces (unshare -Urn)

Discovery Timeline

2026-07-19 - CVE-2026-64119 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64119

Vulnerability Analysis

The defect is a read-copy-update (RCU) list corruption issue in net/l2tp/l2tp_core.c. The function l2tp_session_unhash() removes a session from tunnel->session_list using list_del_init(). That helper sets the deleted entry's next and prev pointers to point back at itself. However, the same list is walked by l2tp_session_get_by_ifname() via list_for_each_entry_rcu() under rcu_read_lock_bh().

When a concurrent reader has already loaded the entry being deleted and then advances pos->list.next, it reads &session->list and container_of()s back to the same session. The iterator never reaches the list head and loops forever. The CPU spins inside strcmp() in the walker with bottom-halves and preemption disabled. RCU grace periods on the host stall behind the wedged loop, and the thread cannot be killed because SIGKILL is delivered only on syscall return.

Root Cause

The root cause is a mismatch between list mutation and list traversal primitives. l2tp_session_register() inserts entries with list_add_rcu(), establishing an RCU-safe publisher. The corresponding removal path used list_del_init(), which does not preserve valid forward pointers for concurrent lockless readers. Readers that observe the deleted node while iterating follow the self-referential pointers back into an infinite loop, classifying this as a race condition [CWE-362] leading to resource exhaustion.

Attack Vector

All three Generic Netlink commands involved (L2TP_CMD_SESSION_GET, L2TP_CMD_SESSION_CREATE, L2TP_CMD_SESSION_DELETE) require only GENL_UNS_ADMIN_PERM. CAP_NET_ADMIN in a network namespace user namespace satisfies this check. A local user can enter a standard unshare -Urn sandbox, create an L2TP tunnel and session, then race repeated lookups by interface name against session create and delete operations. Once a reader locks onto a deleted node, the CPU stays inside the walker indefinitely, denying service to workloads scheduled on that CPU and stalling kernel-wide RCU callbacks.

No verified public proof-of-concept code has been published. See the upstream commit references for the corrected implementation.

Detection Methods for CVE-2026-64119

Indicators of Compromise

Kernel soft-lockup or RCU stall warnings referencing l2tp_session_get_by_ifname in the call trace
Persistent 100% CPU utilization pinned to a single core by a kernel thread that resists SIGKILL
Repeated Generic Netlink traffic containing L2TP_CMD_SESSION_GET, L2TP_CMD_SESSION_CREATE, and L2TP_CMD_SESSION_DELETE from unprivileged UIDs
Unexpected loading of the l2tp_core, l2tp_netlink, or l2tp_eth kernel modules on hosts that do not use L2TP

Detection Strategies

Monitor dmesg and /var/log/kern.log for rcu: INFO: rcu_sched self-detected stall on CPU messages that name L2TP symbols
Correlate unprivileged processes invoking unshare(CLONE_NEWUSER|CLONE_NEWNET) with subsequent netlink activity on the l2tp family
Alert on high sustained per-CPU %sys time bound to a single non-migratable task ID

Monitoring Recommendations

Enable auditd rules for unshare, setns, and clone calls with user-namespace flags from non-root UIDs
Track kernel module autoloading via kmod audit events, focusing on the l2tp_* module family
Ingest kernel logs into a centralized SIEM and build detections for RCU stall traces containing l2tp_session_get_by_ifname

How to Mitigate CVE-2026-64119

Immediate Actions Required

Apply the upstream kernel patches referenced by the stable tree commits 5e40919a40cb, 979c017803c4, acab6314bb75, and e0c3dd7b30cc as soon as your distribution publishes them
Disable unprivileged user namespaces where not required by workloads by setting kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0
Blacklist the l2tp_core, l2tp_netlink, and l2tp_eth modules on hosts that do not require L2TP tunneling

Patch Information

The upstream fix replaces list_del_init() with list_del_rcu() in l2tp_session_unhash() to pair with the existing list_add_rcu() in l2tp_session_register(). The deleted session remains visible to in-flight RCU walkers with consistent next/prev pointers until kfree_rcu() in l2tp_session_free() releases the memory. The patch has no userspace-visible behavior change. See the Kernel Git Commit and the additional stable backports.

Workarounds

Restrict access to the L2TP Generic Netlink family via seccomp or LSM policies for untrusted workloads
Set sysctl -w kernel.unprivileged_userns_clone=0 on Debian-derived distributions to prevent sandbox-based triggering
Unload and blacklist l2tp_* modules on hosts that do not terminate L2TP tunnels

bash

# Configuration example
# Disable unprivileged user namespaces (Debian/Ubuntu)
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system

# Blacklist L2TP modules on hosts that do not need them
cat <<EOF | sudo tee /etc/modprobe.d/blacklist-l2tp.conf
blacklist l2tp_core
blacklist l2tp_netlink
blacklist l2tp_eth
blacklist l2tp_ip
blacklist l2tp_ppp
install l2tp_core /bin/false
EOF

# Verify modules are not currently loaded
lsmod | grep -E '^l2tp'