{"id":"CVE-2024-49940","revision":"0a2bfc8e97f6400eae34bada77c59fec","records":[{"revision":"0a2bfc8e97f6400eae34bada77c59fec","observedAt":"2026-10-30T13:45:33.454+00:00","statement":{"source":"cve-program","id":"CVE-2024-49940","aliases":[],"title":"l2tp: prevent possible tunnel refcount underflow","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: prevent possible tunnel refcount underflow\n\nWhen a session is created, it sets a backpointer to its tunnel. When\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\nrefcount if session->tunnel is non-NULL. However, session->tunnel is\nset in l2tp_session_create, before the tunnel refcount is incremented\nby l2tp_session_register, which leaves a small window where\nsession->tunnel is non-NULL when the tunnel refcount hasn't been\nbumped.\n\nMoving the assignment to l2tp_session_register is trivial but\nl2tp_session_create calls l2tp_session_set_header_len which uses\nsession->tunnel to get the tunnel's encap. Add an encap arg to\nl2tp_session_set_header_len to avoid using session->tunnel.\n\nIf l2tpv3 sessions have colliding IDs, it is possible for\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\nsession which doesn't yet have session->tunnel set. Add a check for\nthis case.","state":0,"publishedAt":"2024-10-21T18:01:59.668+00:00","modifiedAt":"2026-10-30T12:19:44.806+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/l2tp/l2tp_core.c\",\n                        \"net/l2tp/l2tp_core.h\",\n                        \"net/l2tp/l2tp_netlink.c\",\n                        \"net/l2tp/l2tp_ppp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3953ae7b218df4d1e544b98a393666f9ae58a78c\",\n                            \"lessThan\": \"aa7132362e79abc4f2add4d8657dd1679341edc5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3953ae7b218df4d1e544b98a393666f9ae58a78c\",\n                            \"lessThan\": \"98691b2e28a6c3dac0680914493d54c77f215755\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3953ae7b218df4d1e544b98a393666f9ae58a78c\",\n                            \"lessThan\": \"f7415e60c25a6108cd7955a20b2e66b6251ffe02\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3953ae7b218df4d1e544b98a393666f9ae58a78c\",\n                            \"lessThan\": \"24256415d18695b46da06c93135f5b51c548b950\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b102bfc2a90d14f342580285782a9a51c74f7369\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"10c15ddabbcf888922adbdd44ca3fecf6eab19d9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8d1c650d452c53fcb3f02a7b1d772741639f89a4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"12b5fb58ac993c24210cf8cbc72d407d3a4e6490\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"aef37401b467a0b1a9517c69924a1d66937e0789\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3.2.99\",\n                            \"lessThan\": \"3.3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"3.16.54\",\n                            \"lessThan\": \"3.17\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.4.225\",\n                            \"lessThan\": \"4.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.9.225\",\n                            \"lessThan\": \"4.10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.14.182\",\n                            \"lessThan\": \"4.15\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/l2tp/l2tp_core.c\",\n                        \"net/l2tp/l2tp_core.h\",\n                        \"net/l2tp/l2tp_netlink.c\",\n                        \"net/l2tp/l2tp_ppp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.191\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.11.3\",\n                            \"lessThanOrEqual\": \"6.11.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/aa7132362e79abc4f2add4d8657dd1679341edc5","https://git.kernel.org/stable/c/98691b2e28a6c3dac0680914493d54c77f215755","https://git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02","https://git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-49940","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-49940","identifiers":["CVE-2024-49940"]},"retained":false,"historicalAffected":[]}],"coverage":[]}