CVE-2026-53262

In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol2tp_ioctl() read sock->sk->sk_user_data directly without any locks or reference counting. If a controllable sleep was induced during copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger pppol2tp_session_close() asynchronously. This frees the l2tp_session structure via the l2tp_session_del_work workqueue. Upon resuming, the ioctl thread dereferences the stale session pointer, resulting in a Use-After-Free (UAF). Fix this by securely fetching the session reference using the RCU-safe, refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the session's refcount across the sleep. We structured the function to exit via standard err breaks, guaranteeing that l2tp_session_put() is cleanly called on all return paths to drop the reference. To preserve existing behavior we validate the session and its magic signature only for the specific L2TP commands that require it. This ensures that generic/unknown ioctls called on an unconnected socket still return -ENOIOCTLCMD and correctly fall back to generic handlers (e.g. in sock_do_ioctl()).

• https://git.kernel.org/stable/c/62f327e287cf7b595ae3f73ba72f5cd2a9e9f39fPatch
• https://git.kernel.org/stable/c/78cdfdca88cbf731a92f3b9ee5427c633dd94e28Patch
• https://git.kernel.org/stable/c/a213a8950414c684999dcf03edeea6c46ede172ePatch
• https://git.kernel.org/stable/c/e251d4cdfc725c9e7d686161e3b775a0e7d95053Patch

Published

Jun 25, 2026

Last Modified

Jul 8, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53257In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53258In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53259In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-5326A vulnerability was identified in SourceCodester Leave Appli…5.5
• CVE-2026-53260In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-53261In the Linux kernel, the following vulnerability has been re…
• CVE-2026-53263In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53264In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-53265In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-53266In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-53267In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-53268In the Linux kernel, the following vulnerability has been re…8.2