Review reviewHigh

CVE-2026-63918

Linux

In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname A reader in l2tp_session_get_by_ifname() can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plain refcount_inc(), but every other session getter in the same file (l2tp_v2_session_get, l2tp_v3_session_get, and the corresponding _get_next variants) uses refcount_inc_not_zero() because the IDR/RCU lookup can race with refcount_dec_and_test() -> l2tp_session_free() -> kfree_rcu(). The ifname getter is the only outli...

CVSS: 7.8
EPSS: -
CISA KEV: Not listed
Published: 2026.07.20

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux
Affected versions: >= abe7a1a7d0b69e63b1bca5f9531023a52336784f < ee80455feffb9cb62b5b58715cabeff495e666b2, >= abe7a1a7d0b69e63b1bca5f9531023a52336784f < 947013fd7c8c35dd5856557b215840098a3f67f8, >= abe7a1a7d0b69e63b1bca5f9531023a52336784f < 782d60a6596aee9b29c2eecfa70033899278bf65, >= abe7a1a7d0b69e63b1bca5f9531023a52336784f < 05f95729ca844704d15e49ce14868af4b403b32b, >= 6.12
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: Not available