Improper Check or Handling of Exceptional Conditions in Linux kernel - CVE-2026-80996
Published: September 12, 2026
Vulnerability identifier: #VU149399
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80996
CWE-ID: CWE-703
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause live L2TP objects to accumulate.
The vulnerability exists due to improper error handling in the L2TP netlink tunnel and session create and modify handlers when multicast notification delivery fails after a live operation completes. A local user can issue L2TP netlink create or modify commands that are erroneously reported as failed to cause live L2TP objects to accumulate.
Affected software
Linux kernel
How to mitigate CVE-2026-80996
Install security update from vendor's repository.