CVE-2026-23072
- Source
- https://cve.org/CVERecord?id=CVE-2026-23072
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23072.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-23072
- Downstream
- Published
- 2026-02-04T16:07:52.790Z
- Modified
- 2026-02-09T19:36:47.516378Z
- Summary
- l2tp: Fix memleak in l2tp_udp_encap_recv().
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
l2tp: Fix memleak in l2tpudpencap_recv().
syzbot reported memleak of struct l2tpsession, l2tptunnel, sock, etc. [0]
The cited commit moved down the validation of the protocol version in l2tpudpencap_recv().
The new place requires an extra error handling to avoid the memleak.
Let's call l2tpsessionput() there.
unreferenced object 0xffff88810a290200 (size 512): comm "syz.0.17", pid 6086, jiffies 4294944299 hex dump (first 32 bytes): 7d eb 04 0c 00 00 00 00 01 00 00 00 00 00 00 00 }............... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc babb6a4f): kmemleakallocrecursive include/linux/kmemleak.h:44 [inline] slabpostallochook mm/slub.c:4958 [inline] slaballocnode mm/slub.c:5263 [inline] _dokmallocnode mm/slub.c:5656 [inline] _kmallocnoprof+0x3e0/0x660 mm/slub.c:5669 kmallocnoprof include/linux/slab.h:961 [inline] kzallocnoprof include/linux/slab.h:1094 [inline] l2tpsessioncreate+0x3a/0x3b0 net/l2tp/l2tpcore.c:1778 pppol2tpconnect+0x48b/0x920 net/l2tp/l2tpppp.c:755 _sysconnectfile+0x7a/0xb0 net/socket.c:2089 _sysconnect+0xde/0x110 net/socket.c:2108 _dosysconnect net/socket.c:2114 [inline] _sesysconnect net/socket.c:2111 [inline] _x64sysconnect+0x1c/0x30 net/socket.c:2111 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xa4/0xf80 arch/x86/entry/syscall64.c:94 entrySYSCALL64after_hwframe+0x77/0x7f
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23072.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/4d10edfd1475b69dbd4c47f34b61a3772ece83ca
- https://git.kernel.org/stable/c/5cd158a88eef34e7b100cd9b963873d3b4e41b35
- https://git.kernel.org/stable/c/d4ce79e6dce2a4a49eebceea7b4caf5dc0f0ef3d
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23072.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-23072
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced364798056f518b0bf2f17cd9eaf0dd4e856d7393Fixed5cd158a88eef34e7b100cd9b963873d3b4e41b35Fixedd4ce79e6dce2a4a49eebceea7b4caf5dc0f0ef3dFixed4d10edfd1475b69dbd4c47f34b61a3772ece83ca