SB20260827139 - Improper update of reference count in Linux kernel l2tp

Description

This security bulletin contains information about 1 vulnerability.

1) Improper update of reference count (CVE-ID: CVE-2026-74735)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in the l2tp seq_file handlers for /proc/net/pppol2tp and /sys/kernel/debug/l2tp/tunnels when closing the file before reading to end-of-file. A local user can close the file early to cause a denial of service.

The issue occurs because tunnel and session references kept in seq_file private iteration state are not dropped on release.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/9006c116dd111d457bf5d074990210f70a4ad2c8
• https://git.kernel.org/stable/c/ebe2774e956482dd3c70b8991f6f7654356339e6