A use-after-free vulnerability in the Linux kernel L2TP subsystem allows local authenticated attackers to achieve high impact on confidentiality, integrity, and availability.

This vulnerability is a use-after-free flaw caused by using a plain reference increment instead of a safe check in the l2tp_session_get_by_ifname function, requiring low local privileges and no user interaction.

Successful exploitation of this flaw can lead to severe system instability, kernel panics, or arbitrary code execution with kernel-level privileges. This poses a critical risk to data confidentiality and operational integrity. The assigned CVSS score of 7.8 indicates a high severity threat that requires prompt administrative attention for local environments.

Immediate Action: Update the Linux kernel to version 6.12.93, 6.18.35, 7.0.12, or later as appropriate for your distribution.

Proactive Monitoring: Monitor system logs for kernel warnings, reference count errors, or unexpected kernel crashes related to L2TP components.

Compensating Controls: Restrict local shell access and harden system permissions to prevent untrusted local users from executing arbitrary code or interacting directly with vulnerable network interfaces.

Public Exploit Available: No

Administrators managing systems utilizing the L2TP network subsystem should prioritize updating the kernel to the patched versions. Applying the upstream patches eliminates the race condition that triggers the use-after-free state, securing the host against potential privilege escalation and denial-of-service attacks.