Public bug reported:
Package: linux (Ubuntu Noble)
Affected: linux-image-6.8.0-146-generic 6.8.0-146.146
Last good: 6.8.0-142.142 (also 6.8.0-139.139)
== Summary ==
After upgrading from 6.8.0-142 to 6.8.0-146, a host acting as an L2TP/IPsec
server (LNS) and client (LAC) at the same time crashes within 1-10 minutes of
boot: kernel panic ("Fatal exception in interrupt") or a permanent soft lockup.
11 crashes in ~2 hours, all on 6.8.0-146, all inside l2tp_core/l2tp_ppp.
Booting back into 6.8.0-142 fixes it completely (no warnings at all since).
Among the l2tp modules, only l2tp_ppp.ko changed between 142 and 146:
l2tp_core srcversion: D5976517E8DDA0096C46F58 (139, 142, 146 - identical)
l2tp_ppp srcversion: 410F7BD8BFBF7AF73E5803E (139, 142)
5FE6350B4BF3E0647293B12 (146)
Suspected commit (146 changelog, LP: #2164796, CVE-2026-53262):
"l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()"
All failures are refcount errors on the L2TP session object and the faults that
follow from them,
which suggests an unbalanced session reference in the backport.
== Environment ==
Ubuntu 24.04.5 LTS, x86_64
Hardware: YF ADLNN01 (Intel N150), BIOS 5.27 12/17/2025, 4x Intel I226-V (igc)
xl2tpd 1.3.18-1build2, ppp 2.4.9-1+1.1ubuntu4, strongswan
5.9.13-2ubuntu4.24.04.5
Kernel-mode L2TP (l2tp_ppp), L2TP over IPsec transport (ESP in UDP 4500),
xl2tpd configured with one [lns default] (several clients) plus one [lac]
with redial=yes, redial timeout=30.
== Reproduction ==
1. Boot 6.8.0-146 with xl2tpd (LNS + LAC) over strongswan IPsec.
2. Let 2-3 L2TP tunnels come up; reconnects / session teardown happen.
3. Within 1-10 minutes: refcount warnings, then panic or soft lockup.
Not reproducible on 6.8.0-142 (4 boots, hours of uptime, zero warnings).
== Crash signatures (6.8.0-146) ==
1) refcount UAF on RX path (first symptom on every bad boot)
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 42 at lib/refcount.c:25
refcount_warn_saturate+0x12e/0x150
Workqueue: events xfrm_trans_reinject
l2tp_tunnel_get_session+0xc8/0xd0 [l2tp_core]
l2tp_udp_recv_core+0xb1/0x350 [l2tp_core]
l2tp_udp_encap_recv+0x2c/0x54 [l2tp_core]
udp_queue_rcv_one_skb / __udp4_lib_rcv / udp_rcv
followed by:
refcount_t: underflow; use-after-free. (l2tp_session_dec_refcount+0xbb <-
l2tp_udp_recv_core+0x103)
refcount_t: saturated; leaking memory.
2) NULL pointer dereference on TX path -> panic
BUG: kernel NULL pointer dereference, address: 000000000000002d
CPU: 2 PID: 2608 Comm: pppd Tainted: G W 6.8.0-146-generic #146-Ubuntu
xfrm_dst_check+0x24/0x40
__sk_dst_check+0x8f/0xa0
__ip_queue_xmit+0x2a0/0x510
l2tp_xmit_core.constprop.0+0x225/0x460 [l2tp_core]
l2tp_xmit_skb+0x30/0xa0 [l2tp_core]
pppol2tp_xmit+0x114/0x220 [l2tp_ppp]
Kernel panic - not syncing: Fatal exception in interrupt
(other instances: RIP _raw_spin_lock+0x13 / pppol2tp_xmit+0x1e1)
3) Soft lockup in tunnel deletion (host hangs, no auto-reboot)
watchdog: BUG: soft lockup - CPU#1 stuck for 26s..130s! [kworker/u8:3:176]
Workqueue: l2tp l2tp_tunnel_del_work [l2tp_core]
RIP: _raw_spin_lock_bh+0x1b / l2tp_tunnel_del_work+0x98
l2tp_tunnel_del_work+0x8d/0x1b0 [l2tp_core]
process_one_work / worker_thread / kthread
preceded by a warning in pppol2tp_release+0x153 [l2tp_ppp] (sock close path).
Some dumps also show faults in __mptcp_close_ssk / tcp_release_cb_override /
xfrm_bundle_ok after the l2tp refcount warnings. These are most likely
secondary memory corruption.
== Boot statistics ==
6.8.0-139: 16 days uptime, no issues
6.8.0-146: 13 boots in 2h, 11 pstore crash dumps (all l2tp), boots in between
ended in hard hangs
6.8.0-142: 4 boots, 0 refcount warnings, 0 soft lockups, 0 l2tp traces
== Attachments ==
pstore/*.txt - EFI pstore dumps (systemd-pstore). Inside each file the parts
are in reverse order (PartN first). IPv4/MAC addresses redacted.
== Workaround ==
Pin 6.8.0-142 in GRUB and hold linux-image-generic.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: kernel-bug noble regression-update
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169477
Title:
[regression] 6.8.0-146: l2tp/pppol2tp use-after-free -> kernel panic /
soft lockup (L2TP/IPsec, xl2tpd)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2169477/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
