LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23072: l2tp: Fix memleak in l2tp_udp_encap_recv().

In the Linux kernel, the following vulnerability has been resolved: l2tp: Fix memleak in l2tp_udp_encap_recv(). syzbot reported memleak of struct l2tp_session, l2tp_tunnel, sock, etc. [0] The cited commit moved down the validation of the protocol version in l2tp_udp_encap_recv(). The new place requires an extra error handling to avoid the memleak. Let's call l2tp_session_put() there. [0]: BUG: memory leak unreferenced object 0xffff88810a290200 (size 512): comm "syz.0.17", pid 6086, jiffies 4294944299 hex dump (first 32 bytes): 7d eb 04 0c 00 00 00 00 01 00 00 00 00 00 00 00 }............... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc babb6a4f): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4958 [inline] slab_alloc_node mm/slub.c:5263 [inline] __do_kmalloc_node mm/slub.c:5656 [inline] __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] l2tp_session_create+0x3a/0x3b0 net/l2tp/l2tp_core.c:1778 pppol2tp_connect+0x48b/0x920 net/l2tp/l2tp_ppp.c:755 __sys_connect_file+0x7a/0xb0 net/socket.c:2089 __sys_connect+0xde/0x110 net/socket.c:2108 __do_sys_connect net/socket.c:2114 [inline] __se_sys_connect net/socket.c:2111 [inline] __x64_sys_connect+0x1c/0x30 net/socket.c:2111 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-23072 is a Linux kernel L2TP memory leak. In affected kernels, an error path can fail to release L2TP-related objects, gradually consuming memory. The known impact is availability risk, not proven data theft or code execution. The source bundle provides kernel fixes but no CVSS score or active exploitation evidence.

Executive priority

Prioritize routine-to-accelerated kernel patching for hosts using L2TP or exposed network tunneling services. Escalate if L2TP is internet-facing, memory pressure is already observed, or vendor guidance rates the issue higher.

Technical view

The bug is in l2tp_udp_encap_recv(). A prior change moved protocol-version validation and missed error handling on the new failure path. The fix calls l2tp_session_put() to release the session reference and avoid leaks of l2tp_session, l2tp_tunnel, sock, and related allocations reported by syzbot.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel versions with L2TP support in use or reachable. The provided version data is limited and should be validated against distribution kernel advisories and the listed stable commits.

Exploitation context

The bundle marks KEV as false and cites no active exploitation. Evidence comes from a syzbot memory-leak report and Linux stable fixes. Treat this as a potential denial-of-service resource exhaustion issue, not a confirmed exploited vulnerability.

Researcher notes

The public bundle does not include CVSS, CWE, exploitability analysis, or distro-specific package status. The affected-version fields appear limited, so researchers should map exposure by commit ancestry and vendor backports rather than relying only on version labels.

Mitigation direction

  • Update to a Linux kernel or vendor package containing the referenced stable fixes.
  • Check distribution advisories for exact fixed kernel package versions.
  • Disable or restrict unnecessary L2TP functionality where operationally feasible.
  • Monitor affected systems for abnormal kernel memory growth or pressure.

Validation and detection

  • Inventory Linux kernel versions across systems that support or use L2TP.
  • Compare running kernel source or changelog against the three referenced stable commits.
  • Confirm vendor packages explicitly include the l2tp_udp_encap_recv() memory leak fix.
  • Review logs and monitoring for recurring memory pressure on L2TP-enabled hosts.
Prepared
Confidence
medium
Sources
5

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23072 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux364798056f518b0bf2f17cd9eaf0dd4e856d7393, 364798056f518b0bf2f17cd9eaf0dd4e856d7393, 364798056f518b0bf2f17cd9eaf0dd4e856d7393unaffected
LinuxLinux6.10, 0, 6.12.68, 6.18.8, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.