https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 11:29:32 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74735 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>l2tp: fix tunnel and session refcount leak on seq_file release</p> <p>In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state (pd-&gt;tunnel and pd-&gt;session) is kept in seq_file private data to allow iteration across multiple read() system calls.</p> <p>However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reading to end-of-file (EOF), any tunnel or session reference stored in pd-&gt;tunnel / pd-&gt;session is left un-dropped when seq_file private data is freed.</p> <p>Fix this by dropping any remaining pd-&gt;tunnel and pd-&gt;session references in pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>l2tp: fix tunnel and session refcount leak on seq_file release</p> <p>In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state (pd-&gt;tunnel and pd-&gt;session) is kept in seq_file private data to allow iteration across multiple read() system calls.</p> <p>However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reading to end-of-file (EOF), any tunnel or session reference stored in pd-&gt;tunnel / pd-&gt;session is left un-dropped when seq_file private data is freed.</p> <p>Fix this by dropping any remaining pd-&gt;tunnel and pd-&gt;session references in pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.</p> https://vulnerability.circl.lu/vuln/cve-2026-74735