Skip to main content

Linux Kernel EUVDEUVD-2026-39213

| CVE-2026-53262 HIGH
Use After Free (CWE-416)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-5xjr-h8mp-chfc
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Local unprivileged shell access
  2. Delivery
    Open PPPoL2TP socket
  3. Exploit
    Issue ioctl with userfaultfd-backed buffer
  4. Install
    Stall in copy_from_user, close socket to free session
  5. C2
    Resume ioctl, dereference dangling pointer (UAF)
  6. Execute
    Groom freed kernel memory
  7. Impact
    Escalate privileges to root

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires local code execution as an unprivileged user (PR:L) who can open a PPPoL2TP (AF_PPPOX / PX_PROTO_OL2TP) socket, meaning the l2tp_ppp module must be loaded or autoloadable. Exploitation hinges on inducing a controllable sleep inside pppol2tp_ioctl()'s copy_from_user() - the description names a userfaultfd page-fault sleep - so the practical prerequisite is access to a sleep primitive such as unprivileged userfaultfd (CONFIG_USERFAULTFD with vm.unprivileged_userfaultfd enabled). Exploitation is further limited by being a tight race window that must be won against a concurrent socket close, requires no user interaction or network access, and is confined to kernel versions from ~2.6.35 up to the patched stable releases.
Impact

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) reflects a high-impact local flaw, and the impact triad is consistent with a kernel UAF that can yield memory corruption and likely privilege escalation. However, real-world exploitation signals are modest: EPSS is only 0.16% (6th percentile), the CVE is not on CISA KEV, and no public PoC is referenced. Practical exploitation depends on winning a kernel race and, per the description, on a controllable-sleep primitive such as userfaultfd, which is restricted or disabled for unprivileged users in many hardened distributions - so AC:L arguably understates the engineering effort. The 'Information Disclosure' tag conflicts with the CVSS C:H/I:H/A:H profile and the UAF nature, which is more consistent with memory corruption / privilege escalation than pure info leak; treat the tag as imprecise. Net: a genuine but not urgent priority - patch on normal kernel-update cadence rather than emergency unless L2TP/PPP is exposed to untrusted local users.
Exploit ScenarioDerived

A low-privileged local user opens a PPPoL2TP socket and invokes an ioctl whose argument buffer is backed by a userfaultfd-registered page, stalling the kernel inside copy_from_user(). From a second thread they close the socket, triggering asynchronous free of the l2tp_session; when the ioctl resumes it dereferences the freed object, giving a use-after-free that can be groomed toward kernel memory corruption and privilege escalation. No public PoC is currently identified, but the race is well understood from the patch description.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Local privilege escalation via use-after-free in the Linux kernel's L2TP PPP (pppol2tp) subsystem allows a low-privileged local user holding a pppol2tp socket to corrupt freed kernel memory. The flaw is a race in pppol2tp_ioctl(), where sk_user_data was dereferenced without reference counting; an attacker stalls the ioctl mid-copy (e.g. via a userfaultfd page-fault sleep) while concurrently closing the socket, freeing the l2tp_session and leaving a dangling pointer. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 6th percentile).

RemediationAI

Apply the vendor-released patch by upgrading to a fixed stable kernel - 6.12.94, 6.18.36, 7.0.13, or 7.1 or later - or install your distribution's backported kernel update referencing CVE-2026-53262; the upstream fix is in commits at https://git.kernel.org/stable/c/62f327e287cf7b595ae3f73ba72f5cd2a9e9f39f and the related stable commits. If immediate patching is not possible, reduce the attack surface by unloading or blacklisting the l2tp_ppp/pppol2tp kernel module where L2TP/PPP tunneling is not required (side effect: breaks any L2TP PPP VPN functionality), and restrict the controllable-sleep primitive by disabling unprivileged userfaultfd via sysctl vm.unprivileged_userfaultfd=0 (side effect: may affect userspace live-migration or CRIU workloads that rely on it). Limiting local shell access for untrusted users further lowers exploitability.

Affected VersionsENISA

Linux fd558d186df2c13a22455373858bae634a4795af <62f327e287cf7b595ae3f73ba72f5cd2a9e9f39f
Linux patch: 6.18.36
Linux patch: 0
Linux patch: 6.12.94
Linux 2.6.35
Linux fd558d186df2c13a22455373858bae634a4795af <e251d4cdfc725c9e7d686161e3b775a0e7d95053
Linux fd558d186df2c13a22455373858bae634a4795af <78cdfdca88cbf731a92f3b9ee5427c633dd94e28
Linux patch: 7.1
Linux fd558d186df2c13a22455373858bae634a4795af <a213a8950414c684999dcf03edeea6c46ede172e
Linux patch: 7.0.13

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

L2TP (Layer 2 Tunneling Protocol) over PPP is implemented in net/l2tp/l2tp_ppp.c, where each PPPoL2TP socket stores its l2tp_session in sk_user_data. The root cause is a classic CWE-416 Use-After-Free driven by a time-of-check-to-time-of-use race: pppol2tp_ioctl() read sock->sk->sk_user_data with no lock or refcount, so a sleepable window inside copy_from_user() (induced through userfaultfd) let a parallel socket close run pppol2tp_session_close(), which frees the session asynchronously through the l2tp_session_del_work workqueue. The fix acquires an RCU-safe, refcounted handle via pppol2tp_sock_to_session(sk) on entry, pinning the session across the sleep and dropping it with l2tp_session_put() on all exit paths, while preserving -ENOIOCTLCMD fallback for generic ioctls on unconnected sockets.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local low-priv user (AV:L/PR:L), but winning a kernel race plus a userfaultfd sleep primitive makes it high-complexity (AC:H); UAF yields full kernel memory-corruption impact (C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.8 HIGH

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.8
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()

pppol2tp_ioctl() read sock->sk->sk_user_data directly without any locks or reference counting. If a controllable sleep was induced during copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger pppol2tp_session_close() asynchronously. This frees the l2tp_session structure via the l2tp_session_del_work workqueue. Upon resuming, the ioctl thread dereferences the stale session pointer, resulting in a Use-After-Free (UAF).

Fix this by securely fetching the session reference using the RCU-safe, refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the session's refcount across the sleep. We structured the function to exit via standard err breaks, guaranteeing that l2tp_session_put() is cleanly called on all return paths to drop the reference.

To preserve existing behavior we validate the session and its magic signature only for the specific L2TP commands that require it. This ensures that generic/unknown ioctls called on an unconnected socket still return -ENOIOCTLCMD and correctly fall back to generic handlers (e.g. in sock_do_ioctl()).

Executive ViewAI

Why It Matters

A local privilege escalation vulnerability in the Linux kernel's L2TP networking subsystem (CVE-2026-53262) affects systems where untrusted local users can execute code. While technically rated HIGH (CVSS 7.8), real-world organizational risk is minimal: no public exploit identified at time of analysis, and threat modeling indicates only 0.2% exploitation probability. Remediation can be coordinated through standard kernel patching cycles.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel runs across nearly all server and cloud environments
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected
SUSE Linux Micro 6.2 Affected
SUSE Linux Micro Extras 6.2 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53262 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/373821 REF https://git.kernel.org/stable/c/312ecea13b67797747eb9d4b9dab8d3846de6dfb REF https://git.kernel.org/stable/c/62f327e287cf7b595ae3f73ba72f5cd2a9e9f39f REF https://git.kernel.org/stable/c/78cdfdca88cbf731a92f3b9ee5427c633dd94e28 REF https://git.kernel.org/stable/c/a213a8950414c684999dcf03edeea6c46ede172e REF https://git.kernel.org/stable/c/cc19c164a99ab706d4cb45d3c300b305c16798b5 REF https://git.kernel.org/stable/c/e251d4cdfc725c9e7d686161e3b775a0e7d95053

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy