In the Linux kernel, the following vulnerability has been resolved:
l2tp: pass correct message length to ip6appenddata
l2tpip6sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff.
To manage this, we check whether the skbuff contains data using skbqueueempty when deciding how much data to append using ip6appenddata.
However, the code which performed the calculation was incorrect:
 ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0;
...due to C operator precedence, this ends up setting ulen to transhdrlen for messages with a non-zero length, which results in corrupted packets on the wire.
Add parentheses to correct the calculation in line with the original intent.
[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79",
        "target": {
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-4993d9b0",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "161947891814779517236203104587340782408",
                "197803156646160885702743475446133080201",
                "40512133470455514267691333668764350253",
                "126022211672987763863732530850083032256"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@83340c66b498e49353530e41542500fc8a4782d6",
        "target": {
            "function": "l2tp_ip6_sendmsg",
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-63e6a261",
        "signature_version": "v1",
        "digest": {
            "length": 3717.0,
            "function_hash": "11305768551740939405290178167034556366"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcb4d14268595065c85dc5528056713928e17243",
        "target": {
            "function": "l2tp_ip6_sendmsg",
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-6cf7cac2",
        "signature_version": "v1",
        "digest": {
            "length": 3663.0,
            "function_hash": "143184723854036714837228893726672236952"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@804bd8650a3a2bf3432375f8c97d5049d845ce56",
        "target": {
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-86e15c13",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "161947891814779517236203104587340782408",
                "197803156646160885702743475446133080201",
                "40512133470455514267691333668764350253",
                "126022211672987763863732530850083032256"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@804bd8650a3a2bf3432375f8c97d5049d845ce56",
        "target": {
            "function": "l2tp_ip6_sendmsg",
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-95f6494e",
        "signature_version": "v1",
        "digest": {
            "length": 3689.0,
            "function_hash": "275659502953452624684972804414829407209"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcb4d14268595065c85dc5528056713928e17243",
        "target": {
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-9d24798f",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "161947891814779517236203104587340782408",
                "197803156646160885702743475446133080201",
                "40512133470455514267691333668764350253",
                "126022211672987763863732530850083032256"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1d3a84a67db910ce28a871273c992c3d7f9efb5",
        "target": {
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-b9a62943",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "161947891814779517236203104587340782408",
                "197803156646160885702743475446133080201",
                "40512133470455514267691333668764350253",
                "126022211672987763863732530850083032256"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79",
        "target": {
            "function": "l2tp_ip6_sendmsg",
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-be346932",
        "signature_version": "v1",
        "digest": {
            "length": 3743.0,
            "function_hash": "168362279928121779531234625581921572212"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c3ce64bc9d36ca9164dd6c77ff144c121011aae",
        "target": {
            "function": "l2tp_ip6_sendmsg",
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-bfb828c6",
        "signature_version": "v1",
        "digest": {
            "length": 3653.0,
            "function_hash": "213025630947650184036915002567015271415"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0da15a70395182ee8cb75716baf00dddc0bea38d",
        "target": {
            "function": "l2tp_ip6_sendmsg",
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-c978fbe6",
        "signature_version": "v1",
        "digest": {
            "length": 3663.0,
            "function_hash": "143184723854036714837228893726672236952"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0da15a70395182ee8cb75716baf00dddc0bea38d",
        "target": {
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-ca68d6d4",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "161947891814779517236203104587340782408",
                "197803156646160885702743475446133080201",
                "40512133470455514267691333668764350253",
                "126022211672987763863732530850083032256"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c3ce64bc9d36ca9164dd6c77ff144c121011aae",
        "target": {
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-d90d5b2a",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "161947891814779517236203104587340782408",
                "197803156646160885702743475446133080201",
                "40512133470455514267691333668764350253",
                "126022211672987763863732530850083032256"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@83340c66b498e49353530e41542500fc8a4782d6",
        "target": {
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-dbdf4a7f",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "161947891814779517236203104587340782408",
                "197803156646160885702743475446133080201",
                "40512133470455514267691333668764350253",
                "126022211672987763863732530850083032256"
            ]
        },
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13cd1daeea848614e585b2c6ecc11ca9c8ab2500",
        "target": {
            "function": "l2tp_ip6_sendmsg",
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-f12da8fb",
        "signature_version": "v1",
        "digest": {
            "length": 3689.0,
            "function_hash": "275659502953452624684972804414829407209"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1d3a84a67db910ce28a871273c992c3d7f9efb5",
        "target": {
            "function": "l2tp_ip6_sendmsg",
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-f47069a5",
        "signature_version": "v1",
        "digest": {
            "length": 3663.0,
            "function_hash": "143184723854036714837228893726672236952"
        },
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@13cd1daeea848614e585b2c6ecc11ca9c8ab2500",
        "target": {
            "file": "net/l2tp/l2tp_ip6.c"
        },
        "deprecated": false,
        "id": "CVE-2024-26752-f484ce27",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "161947891814779517236203104587340782408",
                "197803156646160885702743475446133080201",
                "40512133470455514267691333668764350253",
                "126022211672987763863732530850083032256"
            ]
        },
        "signature_type": "Line"
    }
]