Public bug reported:
Since upgrading to linux-image-6.8.0-147-generic (6.8.0-147.147), connecting to
an
L2TP/IPsec VPN via network-manager-l2tp produces refcount_t use-after-free
warnings in
l2tp_core as soon as the tunnel comes up. The system later panics or shows slab
corruption.
Environment
- Ubuntu 24.04.5 LTS, kernel 6.8.0-147-generic #147-Ubuntu
- Lenovo 21MMSHV500, BIOS N47ET25W (1.14), Intel Core Ultra 7 155U
- network-manager-l2tp 1.20.12-1build2, strongSwan, pppd 2.4.9 (pppol2tp plugin)
Steps to reproduce
1. Boot 6.8.0-147-generic.
2. Connect an L2TP/IPsec VPN through NetworkManager.
3. Observe the warnings in dmesg within seconds of PPP authentication.
4. Pass traffic, then disconnect the VPN.
Observed
Warnings appeared in all 3 boots on 6.8.0-147 that used the VPN:
- 2026-10-29 15:59: general protection fault in l2tp_tunnel_get_session, then
"Kernel panic - not syncing: Fatal exception in interrupt"
- 2026-10-29 16:30-17:18: repeated page faults in kmalloc_node_trace/__kmalloc
in unrelated
tasks (cron, sa1, alsactl, wireplumber), consistent with slab corruption
- 2026-11-06 18:06: about 10 s after disconnecting the VPN, UBSAN
array-index-out-of-bounds
in qspinlock.c:131, page fault in native_queued_spin_lock_slowpath, called
from
l2tp_xmit_core <- pppol2tp_xmit <- ppp_write (comm: pppd), then
"Kernel panic - not syncing: Fatal exception in interrupt"
First warnings, each in kworker running xfrm_trans_reinject:
refcount_t: addition on 0; use-after-free (l2tp_tunnel_get_session <-
l2tp_udp_recv_core)
refcount_t: underflow; use-after-free (l2tp_session_dec_refcount <-
l2tp_udp_recv_core)
refcount_t: saturated; leaking memory (l2tp_tunnel_get_session <-
l2tp_udp_recv_core)
Expected
The VPN connects and disconnects without kernel warnings or a panic.
Regression information
The same VPN produced no such warnings in 3 boots in September 2026 on older
kernels (at
least 6.8.0-139). 6.8.0-142 and -146 were installed but not tested with this
VPN, so the
regression range is 6.8.0-139 to -147 and has not been narrowed further.
Possibly related, unconfirmed: CVE-2026-63918 fixes a similar refcount_inc()
issue in
l2tp_session_get_by_ifname(), but that function does not appear in these traces.
Attachment: l2tp-crash-excerpt.txt (warnings from the journal, panic
records from EFI pstore).
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: linux-image-6.8.0-147-generic 6.8.0-147.147
ProcVersionSignature: Ubuntu 6.8.0-147.147-generic 6.8.12
Uname: Linux 6.8.0-147-generic x86_64
ApportVersion: 2.28.3-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: szzs 1971 F.... pipewire
szzs 1975 F.... wireplumber
/dev/snd/seq: szzs 1971 F.... pipewire
CRDA: N/A
CasperMD5CheckResult: pass
CurrentDesktop: XFCE
Date: Fri Nov 6 18:27:22 2026
InstallationDate: Installed on 2026-07-29 (100 days ago)
InstallationMedia: Xubuntu 24.04 LTS "Noble Numbat" - Release amd64 (20240424.2)
MachineType: LENOVO 21MMSHV500
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-147-generic
root=UUID=c9561ae7-4bbb-4bf6-b5be-d6137a14f6eb ro quiet splash vt.handoff=7
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No
PulseAudio daemon running, or not running as session daemon.
RelatedPackageVersions:
linux-restricted-modules-6.8.0-147-generic N/A
linux-backports-modules-6.8.0-147-generic N/A
linux-firmware 20240318.git3b128b60.0ubuntu3.1
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 04/14/2025
dmi.bios.release: 1.14
dmi.bios.vendor: LENOVO
dmi.bios.version: N47ET25W (1.14 )
dmi.board.asset.tag: Not Available
dmi.board.name: 21MMSHV500
dmi.board.vendor: LENOVO
dmi.board.version: Not Defined
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: None
dmi.ec.firmware.release: 1.11
dmi.modalias:
dmi:bvnLENOVO:bvrN47ET25W(1.14):bd04/14/2025:br1.14:efr1.11:svnLENOVO:pn21MMSHV500:pvrThinkPadT14Gen5:rvnLENOVO:rn21MMSHV500:rvrNotDefined:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_21MM_BU_Think_FM_ThinkPadT14Gen5:
dmi.product.family: ThinkPad T14 Gen 5
dmi.product.name: 21MMSHV500
dmi.product.sku: LENOVO_MT_21MM_BU_Think_FM_ThinkPad T14 Gen 5
dmi.product.version: ThinkPad T14 Gen 5
dmi.sys.vendor: LENOVO
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2173565
Title:
noble 6.8.0-147: L2TP/IPsec VPN triggers refcount use-after-free in
l2tp_core, kernel panic on disconnect
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2173565/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
