CVE-2026-74735: Linux Kernel L2TP Privilege Escalation

CVE-2026-74735 Overview

CVE-2026-74735 is a reference count leak vulnerability in the Linux kernel's Layer 2 Tunneling Protocol (L2TP) subsystem. The flaw resides in the pppol2tp_proc_open() and l2tp_dfs_seq_open() functions, which store iteration state (pd->tunnel and pd->session) in seq_file private data. When userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reading to end-of-file, the stored tunnel and session references are not released. This produces a persistent kernel resource leak.

Critical Impact
Repeated early closure of L2TP seq_file handles leaks tunnel and session references in kernel memory, potentially preventing cleanup of L2TP objects and enabling denial-of-service conditions on affected systems.

Affected Products

Linux kernel L2TP subsystem (net/l2tp)
Systems exposing /proc/net/pppol2tp via the PPPoL2TP driver
Systems exposing /sys/kernel/debug/l2tp/tunnels via debugfs

Discovery Timeline

2026-08-26 - CVE-2026-74735 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-74735

Vulnerability Analysis

The Linux kernel's L2TP subsystem exposes iteration interfaces through procfs and debugfs for administrative visibility into active tunnels and sessions. Both pppol2tp_proc_open() and l2tp_dfs_seq_open() allocate a private data structure that tracks the current iteration position using pointers to L2TP tunnel and session objects. These pointers hold reference counts on the corresponding kernel structures so they remain valid across sequential read() calls.

The release paths did not drop the residual references stored in pd->tunnel and pd->session when the file descriptor was closed prematurely. Any process that opened the file and closed it before reaching end-of-file left the reference counts elevated. The bug maps to a resource management defect ([CWE-772] Missing Release of Resource).

Root Cause

Iteration through L2TP tunnels and sessions is stateful: each step in the sequence acquires a reference on the next object and releases the previous one. Reaching EOF triggers the final reference drop through the normal iteration path. When userspace closes the file early, the seq_file private data is freed without traversing that path, orphaning the last held references.

Attack Vector

A local user with permission to open /proc/net/pppol2tp or the L2TP debugfs entries can trigger the leak by repeatedly opening and closing these files without reading to EOF. Sustained exploitation increases refcounts on tunnel and session objects, preventing their teardown and consuming kernel memory. Access to debugfs typically requires elevated privileges, while procfs exposure depends on distribution policy.

The fix drops any remaining pd->tunnel and pd->session references in pppol2tp_proc_release() and l2tp_dfs_seq_release(). See the upstream commits Kernel Git Commit 9006c11 and Kernel Git Commit ebe2774e for the exact source-level changes.

Detection Methods for CVE-2026-74735

Indicators of Compromise

Growing kernel memory usage attributable to L2TP tunnel or session slab caches without corresponding active tunnel growth.
L2TP tunnels or sessions that persist after administrative teardown attempts, indicating elevated refcounts.
Anomalous open/close activity against /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels from non-administrative processes.

Detection Strategies

Audit process access to the L2TP procfs and debugfs paths using auditd or eBPF-based file access telemetry.
Track slab allocations for L2TP objects with slabtop or /proc/slabinfo and correlate against the count of live tunnels reported by ip l2tp show tunnel.
Alert on rapid, repeated open()/close() sequences targeting L2TP status files without intervening read() to EOF.

Monitoring Recommendations

Baseline normal L2TP interface usage and alert on divergence between reported tunnels and kernel object counts.
Forward kernel memory pressure metrics and process file-access events to a centralized analytics pipeline for correlation.
Review kernel version inventory to identify hosts running unpatched L2TP code paths.

How to Mitigate CVE-2026-74735

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 9006c11 and ebe2774e or install the stable kernel release that includes them.
Restrict access to /sys/kernel/debug/l2tp/ by ensuring debugfs is mounted only where required and readable solely by root.
Audit which local accounts and services can read /proc/net/pppol2tp and remove unnecessary access.

Patch Information

The vulnerability is resolved by dropping residual references in pppol2tp_proc_release() and l2tp_dfs_seq_release(). Refer to Kernel Git Commit 9006c11 and Kernel Git Commit ebe2774e for the fix. Distribution vendors will backport these changes into supported stable branches; update through the standard package manager once the fixed kernel is available.

Workarounds

Unmount debugfs (umount /sys/kernel/debug) on production hosts that do not require it.
Tighten permissions on /proc/net/pppol2tp and the L2TP debugfs directory using mount options or restrictive DAC controls.
Unload the l2tp_ppp and related L2TP kernel modules on systems that do not use L2TP tunneling.

bash

# Configuration example
# Restrict debugfs to root and unload L2TP modules where unused
mount -o remount,mode=700 /sys/kernel/debug
modprobe -r l2tp_ppp l2tp_netlink l2tp_core 2>/dev/null || true
# Verify no L2TP tunnels remain
ip l2tp show tunnel