l2tp: prevent possible tunnel refcount underflow
CVE-2024-49940 · published 21 Oct 2024
How serious is it
- Severity: high, CVSS score 7.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2024-49940?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 3953ae7b218df4d1e544b98a393666f9ae58a78c to < 98691b2e28a6c3dac0680914493d54c77f215755, 3953ae7b218df4d1e544b98a393666f9ae58a78c to < f7415e60c25a6108cd7955a20b2e66b6251ffe02, 3953ae7b218df4d1e544b98a393666f9ae58a78c to < 24256415d18695b46da06c93135f5b51c548b950, b102bfc2a90d14f342580285782a9a51c74f7369
- Linux Linux: 4.15
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
l2tp: prevent possible tunnel refcount underflow
When a session is created, it sets a backpointer to its tunnel. When
the session refcount drops to 0, l2tp_session_free drops the tunnel
refcount if session->tunnel is non-NULL. However, session->tunnel is
set in l2tp_session_create, before the tunnel refcount is incremented
by l2tp_session_register, which leaves a small window where
session->tunnel is non-NULL when the tunnel refcount hasn't been
bumped.
Moving the assignment to l2tp_session_register is trivial but
l2tp_session_create calls l2tp_session_set_header_len which uses
session->tunnel to get the tunnel's encap. Add an encap arg to
l2tp_session_set_header_len to avoid using session->tunnel.
If l2tpv3 sessions have colliding IDs, it is possible for
l2tp_v3_session_get to race with l2tp_session_register and fetch a
session which doesn't yet have session->tunnel set. Add a check for
this case.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/98691b2e28a6c3dac0680914493d54c77f215755
- git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02
- git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950
Merged from CVE List. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON