Security readout for executives and security teams
Plain-English summary
CVE-2026-23120 is a Linux kernel race condition in L2TP tunnel cleanup. The public record shows it was found by syzbot/KCSAN and fixed in stable kernel commits. No CVSS score, business impact, or active exploitation evidence is provided, so urgency depends on whether affected Linux kernels and L2TP functionality are present.
Executive priority
Do not treat this as an emergency based on current public evidence. Assign normal kernel patch management priority, with faster remediation for VPN or networking systems using L2TP because they are more likely to reach the affected code path.
Technical view
The issue is a data race between l2tp_tunnel_del_work() reading sk->sk_socket and socket release code clearing that pointer. The fix narrows sk->sk_socket reads to kernel-socket handling. Sources identify Linux kernel as affected across listed version/range markers and provide multiple stable backport commits, but do not describe exploitability or attacker prerequisites.
Likely exposure
Exposure is likely limited to systems running affected Linux kernels where the L2TP kernel path can be exercised. VPN, networking, appliance, and hosting environments should check kernel versions and L2TP use. The provided data does not prove remote exposure or default exploitability.
Exploitation context
The source bundle shows syzbot reported a KCSAN data race. KEV is false, and no cited source claims active exploitation, public exploit availability, privilege requirements, or practical attack impact. Treat exploitation status as unconfirmed.
Researcher notes
The record provides a concrete race trace and stable commit references but no CVSS, CWE, exploitability analysis, or impact statement. Researchers should focus on reproducing version exposure and understanding whether local L2TP operations can trigger meaningful denial-of-service or memory-safety outcomes.
Mitigation direction
- Inventory Linux kernel versions on affected assets.
- Check vendor advisories for kernels containing the referenced stable commits.
- Prioritize updates for systems using L2TP or VPN networking roles.
- Disable unused L2TP functionality where operationally safe.
- Monitor distribution security channels for severity and package guidance.
Validation and detection
- Confirm deployed kernel versions against vendor fixed builds.
- Verify whether L2TP modules or services are enabled.
- Review kernel package changelogs for CVE-2026-23120 or referenced commits.
- Track whether scanners recognize this CVE after vendor metadata updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23120 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1f63ca44b4f419a1663d94d1bb0b4e2beb73fdb4CVE reference, Linux
- https://git.kernel.org/stable/c/36c40a80109f1771d59558050b1a71e13c60c759CVE reference, Linux
- https://git.kernel.org/stable/c/eae074dab764ea181bbed5e88626889319177498CVE reference, Linux
- https://git.kernel.org/stable/c/68e92085427c84e7679ddb53c0d68836d220b6e7CVE reference, Linux
- https://git.kernel.org/stable/c/3d6d414b214ce31659bded2f8df50c93a3769474CVE reference, Linux
- https://git.kernel.org/stable/c/32d417497b79efb403d75f4c185fe6fd9d64b94fCVE reference, Linux
- https://git.kernel.org/stable/c/7a29f6bf60f2590fe5e9c4decb451e19afad2bcfCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.