CVE-2026-64119

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An unprivileged local user can cause a host CPU to pin indefinitely. This occurs when L2TP CMD SESSION GET is issued on L2TP ATTR IFNAME concurrently with L2TP CMD SESSION CREATE and L2TP CMD SESSION DELETE on the same tunnel. The issue stems from the l2tp session unhash() function using list del init() to remove a session from tunnel->session list, while l2tp session get by ifname() walks the same list using list for each entry rcu() under rcu read lock bh(). Because list del init() leaves the deleted entry self-pointing, a reader may enter an infinite loop in strcmp(), disabling bottom halves (BH) and preemption, which stalls RCU grace periods on the host and prevents the thread from being killed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.