AZL-97743
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-97743.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-97743
- Upstream
- Published
- 2026-08-26T15:16:52Z
- Modified
- 2026-08-29T05:27:27Z
- Summary
- CVE-2026-74735 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
l2tp: fix tunnel and session refcount leak on seq_file release
In pppol2tpprocopen() and l2tpdfsseqopen(), iteration state (pd->tunnel and pd->session) is kept in seqfile private data to allow iteration across multiple read() system calls.
However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reading to end-of-file (EOF), any tunnel or session reference stored in pd->tunnel / pd->session is left un-dropped when seq_file private data is freed.
Fix this by dropping any remaining pd->tunnel and pd->session references in pppol2tpprocrelease() and l2tpdfsseq_release() when closing the file.
- References