{"id":"CVE-2024-49940","state":"PUBLISHED","title":"l2tp: prevent possible tunnel refcount underflow","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: prevent possible tunnel refcount underflow\n\nWhen a session is created, it sets a backpointer to its tunnel. When\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\nrefcount if session->tunnel is non-NULL. However, session->tunnel is\nset in l2tp_session_create, before the tunnel refcount is incremented\nby l2tp_session_register, which leaves a small window where\nsession->tunnel is non-NULL when the tunnel refcount hasn't been\nbumped.\n\nMoving the assignment to l2tp_session_register is trivial but\nl2tp_session_create calls l2tp_session_set_header_len which uses\nsession->tunnel to get the tunnel's encap. Add an encap arg to\nl2tp_session_set_header_len to avoid using session->tunnel.\n\nIf l2tpv3 sessions have colliding IDs, it is possible for\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\nsession which doesn't yet have session->tunnel set. Add a check for\nthis case.","publishedAt":"2024-10-21T18:01:59.668Z","updatedAt":"2026-10-30T12:19:44.806Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3953ae7b218df4d1e544b98a393666f9ae58a78c","status":"affected","lessThan":"aa7132362e79abc4f2add4d8657dd1679341edc5","versionType":"git"},{"version":"3953ae7b218df4d1e544b98a393666f9ae58a78c","status":"affected","lessThan":"98691b2e28a6c3dac0680914493d54c77f215755","versionType":"git"},{"version":"3953ae7b218df4d1e544b98a393666f9ae58a78c","status":"affected","lessThan":"f7415e60c25a6108cd7955a20b2e66b6251ffe02","versionType":"git"},{"version":"3953ae7b218df4d1e544b98a393666f9ae58a78c","status":"affected","lessThan":"24256415d18695b46da06c93135f5b51c548b950","versionType":"git"},{"version":"b102bfc2a90d14f342580285782a9a51c74f7369","status":"affected","versionType":"git"},{"version":"10c15ddabbcf888922adbdd44ca3fecf6eab19d9","status":"affected","versionType":"git"},{"version":"8d1c650d452c53fcb3f02a7b1d772741639f89a4","status":"affected","versionType":"git"},{"version":"12b5fb58ac993c24210cf8cbc72d407d3a4e6490","status":"affected","versionType":"git"},{"version":"aef37401b467a0b1a9517c69924a1d66937e0789","status":"affected","versionType":"git"},{"version":"3.2.99","status":"affected","lessThan":"3.3","versionType":"semver"},{"version":"3.16.54","status":"affected","lessThan":"3.17","versionType":"semver"},{"version":"4.4.225","status":"affected","lessThan":"4.5","versionType":"semver"},{"version":"4.9.225","status":"affected","lessThan":"4.10","versionType":"semver"},{"version":"4.14.182","status":"affected","lessThan":"4.15","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/l2tp/l2tp_core.c","net/l2tp/l2tp_core.h","net/l2tp/l2tp_netlink.c","net/l2tp/l2tp_ppp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.15","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.11.3","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/l2tp/l2tp_core.c","net/l2tp/l2tp_core.h","net/l2tp/l2tp_netlink.c","net/l2tp/l2tp_ppp.c"]}],"references":["https://git.kernel.org/stable/c/aa7132362e79abc4f2add4d8657dd1679341edc5","https://git.kernel.org/stable/c/98691b2e28a6c3dac0680914493d54c77f215755","https://git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02","https://git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950"],"weaknesses":[],"ingestedAt":"2026-10-30T12:36:04.432Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/49xxx/CVE-2024-49940.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-49940","state":"PUBLISHED","datePublished":"2024-10-21T18:01:59.668Z","dateUpdated":"2026-10-30T12:19:44.806Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-10-21T12:17:06.043Z"},"containers":{"cna":{"title":"l2tp: prevent possible tunnel refcount underflow","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: prevent possible tunnel refcount underflow\n\nWhen a session is created, it sets a backpointer to its tunnel. When\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\nrefcount if session->tunnel is non-NULL. However, session->tunnel is\nset in l2tp_session_create, before the tunnel refcount is incremented\nby l2tp_session_register, which leaves a small window where\nsession->tunnel is non-NULL when the tunnel refcount hasn't been\nbumped.\n\nMoving the assignment to l2tp_session_register is trivial but\nl2tp_session_create calls l2tp_session_set_header_len which uses\nsession->tunnel to get the tunnel's encap. Add an encap arg to\nl2tp_session_set_header_len to avoid using session->tunnel.\n\nIf l2tpv3 sessions have colliding IDs, it is possible for\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\nsession which doesn't yet have session->tunnel set. Add a check for\nthis case."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3953ae7b218df4d1e544b98a393666f9ae58a78c","status":"affected","lessThan":"aa7132362e79abc4f2add4d8657dd1679341edc5","versionType":"git"},{"version":"3953ae7b218df4d1e544b98a393666f9ae58a78c","status":"affected","lessThan":"98691b2e28a6c3dac0680914493d54c77f215755","versionType":"git"},{"version":"3953ae7b218df4d1e544b98a393666f9ae58a78c","status":"affected","lessThan":"f7415e60c25a6108cd7955a20b2e66b6251ffe02","versionType":"git"},{"version":"3953ae7b218df4d1e544b98a393666f9ae58a78c","status":"affected","lessThan":"24256415d18695b46da06c93135f5b51c548b950","versionType":"git"},{"version":"b102bfc2a90d14f342580285782a9a51c74f7369","status":"affected","versionType":"git"},{"version":"10c15ddabbcf888922adbdd44ca3fecf6eab19d9","status":"affected","versionType":"git"},{"version":"8d1c650d452c53fcb3f02a7b1d772741639f89a4","status":"affected","versionType":"git"},{"version":"12b5fb58ac993c24210cf8cbc72d407d3a4e6490","status":"affected","versionType":"git"},{"version":"aef37401b467a0b1a9517c69924a1d66937e0789","status":"affected","versionType":"git"},{"version":"3.2.99","status":"affected","lessThan":"3.3","versionType":"semver"},{"version":"3.16.54","status":"affected","lessThan":"3.17","versionType":"semver"},{"version":"4.4.225","status":"affected","lessThan":"4.5","versionType":"semver"},{"version":"4.9.225","status":"affected","lessThan":"4.10","versionType":"semver"},{"version":"4.14.182","status":"affected","lessThan":"4.15","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/l2tp/l2tp_core.c","net/l2tp/l2tp_core.h","net/l2tp/l2tp_netlink.c","net/l2tp/l2tp_ppp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.15","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.11.3","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/l2tp/l2tp_core.c","net/l2tp/l2tp_core.h","net/l2tp/l2tp_netlink.c","net/l2tp/l2tp_ppp.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/aa7132362e79abc4f2add4d8657dd1679341edc5"},{"url":"https://git.kernel.org/stable/c/98691b2e28a6c3dac0680914493d54c77f215755"},{"url":"https://git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02"},{"url":"https://git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The refcount underflow is triggered by local session creation — either the L2TP generic-netlink `L2TP_CMD_SESSION_CREATE` command or a `connect()` on an `AF_PPPOX`/`PX_PROTO_OL2TP` socket. A remote peer cannot itself drive `l2tp_session_create()`/`l2tp_session_register()`, though remote packets in `l2tp_udp_encap_recv()` are what subsequently dereference the prematurely freed tunnel.\nAC:L - The attacker fully controls both sides: they choose the session ID, so they can deterministically force `l2tp_session_register()` to fail (`-EEXIST` on a colliding L2TPv3 ID, or `-ENODEV`), and they can run concurrent create/teardown threads to widen the window between `l2tp_session_create()` and the tunnel refcount bump. No condition outside attacker influence is required, and L2TP is a stock distro module.\nPR:L - `pppol2tp_create()`/`pppox_create()` perform no capability check, so a plain unprivileged local user can reach `l2tp_session_create()` and `l2tp_session_register()` through `connect()`. The netlink path is `GENL_UNS_ADMIN_PERM` (CAP_NET_ADMIN against the netns user_ns), which any unprivileged user obtains via `unshare -Urn`.\nUI:N - The attacker performs the entire sequence — tunnel setup, session creation with a colliding ID, and session teardown — from their own process. No victim action or cooperating user is involved.\nS:U - The underflow and the resulting use-after-free are confined to the kernel's own l2tp objects within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dropped-too-early tunnel reference frees `struct l2tp_tunnel` while `session->tunnel` and the datapath still reference it, giving a use-after-free on a kmalloc'd object that can be reclaimed with attacker-sprayed data and then read back (e.g. `tunnel->sock`, `tunnel->encap`, `tunnel->version` used in `l2tp_recv_common()`/`l2tp_xmit_skb()`), enabling kernel memory disclosure.\nI:H - A use-after-free on the tunnel object lets an attacker reoccupy the freed slab and control fields such as `tunnel->sock`, which the transmit and receive paths dereference and pass to socket operations, yielding a write/control-flow-hijack primitive. Additionally the extra `l2tp_tunnel_dec_refcount()` corrupts kernel reference-counting state itself.\nA:H - Premature tunnel free reliably produces an oops/panic when the still-live session or a received L2TP packet dereferences the dangling `session->tunnel`, and the `refcount_t` underflow itself raises a WARN that panics on `panic_on_warn` systems."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:19:44.806Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.11.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.99"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.225"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.225"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.182"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-49940","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-10-22T13:37:52.827630Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-22T13:38:50.656Z"}}]}}}