CVE-2026-74735

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A reference count leak occurs in the L2TP module when userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reaching the end-of-file. The iteration state, specifically pd->tunnel and pd->session, is stored in the seq file private data to support reading across multiple system calls. If the file is closed prematurely, the references stored in pd->tunnel and pd->session are not dropped when the private data is freed. This issue involves the pppol2tp proc open(), l2tp dfs seq open(), pppol2tp proc release(), and l2tp dfs seq release() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.