GHSA-WF96-M5FP-JH8C
Vulnerability from github – Published: 2026-09-21 15:31 – Updated: 2026-09-21 15:31In the Linux kernel, the following vulnerability has been resolved:
l2tp: fix tunnel and session refcount leak on seq_file release
In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state (pd->tunnel and pd->session) is kept in seq_file private data to allow iteration across multiple read() system calls.
However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reading to end-of-file (EOF), any tunnel or session reference stored in pd->tunnel / pd->session is left un-dropped when seq_file private data is freed.
Fix this by dropping any remaining pd->tunnel and pd->session references in pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.
{
"affected": [],
"aliases": [
"CVE-2026-74735"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-26T15:16:52Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: fix tunnel and session refcount leak on seq_file release\n\nIn pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state\n(pd-\u003etunnel and pd-\u003esession) is kept in seq_file private data to allow\niteration across multiple read() system calls.\n\nHowever, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels\nbefore reading to end-of-file (EOF), any tunnel or session reference stored in\npd-\u003etunnel / pd-\u003esession is left un-dropped when seq_file private data is freed.\n\nFix this by dropping any remaining pd-\u003etunnel and pd-\u003esession references in\npppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.",
"id": "GHSA-wf96-m5fp-jh8c",
"modified": "2026-09-21T15:31:30Z",
"published": "2026-09-21T15:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74735"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8c4fde01bcf91f22b9c7ded8c3e14addd7ddd500"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9006c116dd111d457bf5d074990210f70a4ad2c8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/bdf83613781956cc39798ed08321f74ab0467f4d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ebe2774e956482dd3c70b8991f6f7654356339e6"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.