{"id":"CVE-2026-74735","summary":"l2tp: fix tunnel and session refcount leak on seq_file release","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: fix tunnel and session refcount leak on seq_file release\n\nIn pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state\n(pd-\u003etunnel and pd-\u003esession) is kept in seq_file private data to allow\niteration across multiple read() system calls.\n\nHowever, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels\nbefore reading to end-of-file (EOF), any tunnel or session reference stored in\npd-\u003etunnel / pd-\u003esession is left un-dropped when seq_file private data is freed.\n\nFix this by dropping any remaining pd-\u003etunnel and pd-\u003esession references in\npppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.","modified":"2026-10-28T02:30:45.296929971Z","published":"2026-08-26T14:36:49.352Z","related":["SUSE-SU-2026:24179-1","SUSE-SU-2026:24181-1","SUSE-SU-2026:24182-1","SUSE-SU-2026:24184-1","SUSE-SU-2026:24197-1","SUSE-SU-2026:24235-1","SUSE-SU-2026:24315-1","SUSE-SU-2026:24316-1","SUSE-SU-2026:4640-1","SUSE-SU-2026:4706-1","openSUSE-SU-2026:22091-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74735.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/8c4fde01bcf91f22b9c7ded8c3e14addd7ddd500"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9006c116dd111d457bf5d074990210f70a4ad2c8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bd897e414451fb34dfdf08b31899180e5ab7149b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bdf83613781956cc39798ed08321f74ab0467f4d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ebe2774e956482dd3c70b8991f6f7654356339e6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74735.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74735"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443"},{"fixed":"bd897e414451fb34dfdf08b31899180e5ab7149b"},{"fixed":"bdf83613781956cc39798ed08321f74ab0467f4d"},{"fixed":"8c4fde01bcf91f22b9c7ded8c3e14addd7ddd500"},{"fixed":"ebe2774e956482dd3c70b8991f6f7654356339e6"},{"fixed":"9006c116dd111d457bf5d074990210f70a4ad2c8"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3.16.60"},{"fixed":"3.17"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4.16.6"},{"fixed":"4.17"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f6104e9ae04462523c372928b1173766a771ef95"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"7f8e401f9e612df2a95c1ef76217c00181389bb5"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c712ed63e9b33d9a282fbd92ce25c64918c3129f"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9a8863e8a8def9d88583cd9c60db38a008e6b8cf"}]}],"versions":["v3.16.85","v3.16.84","v3.16.83","v3.16.82","v3.16.81","v3.16.80","v3.16.79","v3.16.78","v3.16.77","v3.16.76","v3.16.75","v3.16.74","v3.16.73","v3.16.72","v3.16.71","v3.16.70","v3.16.69","v3.16.68","v3.16.67","v3.16.66","v3.16.65","v3.16.64","v3.16.63","v3.16.62","v3.16.61","v3.16.60","v4.16.18","v4.16.17","v4.16.16","v4.16.15","v4.16.14","v4.16.13","v4.16.12","v4.16.11","v4.16.10","v4.16.9","v4.16.8","v4.16.7","v4.16.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74735.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.0"},{"fixed":"6.6.160"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.111"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.53"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.10"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74735.json"}}],"schema_version":"1.9.2"}