CVE-2026-63918

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the l2tp session get by ifname() function. A reader matching session->ifname can be preempted between the strcmp() and refcount inc() operations. If the last reference to the session is dropped on another CPU during this window, refcount inc() operates on a counter that has already reached zero. This leads to a slab-use-after-free, where the system attempts to access session memory after it has been freed by the kfree rcu() callback. This issue is particularly relevant on PREEMPT RT kernels where local bh disable() is a per-CPU sleeping lock.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.