GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-49940 (GCVE-0-2024-49940)

Vulnerability from cvelistv5 – Published: 2024-10-21 18:01 – Updated: 2026-08-05 11:40
VLAI
Title
l2tp: prevent possible tunnel refcount underflow
Summary
In the Linux kernel, the following vulnerability has been resolved: l2tp: prevent possible tunnel refcount underflow When a session is created, it sets a backpointer to its tunnel. When the session refcount drops to 0, l2tp_session_free drops the tunnel refcount if session->tunnel is non-NULL. However, session->tunnel is set in l2tp_session_create, before the tunnel refcount is incremented by l2tp_session_register, which leaves a small window where session->tunnel is non-NULL when the tunnel refcount hasn't been bumped. Moving the assignment to l2tp_session_register is trivial but l2tp_session_create calls l2tp_session_set_header_len which uses session->tunnel to get the tunnel's encap. Add an encap arg to l2tp_session_set_header_len to avoid using session->tunnel. If l2tpv3 sessions have colliding IDs, it is possible for l2tp_v3_session_get to race with l2tp_session_register and fetch a session which doesn't yet have session->tunnel set. Add a check for this case.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:37 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3953ae7b218df4d1e544b98a393666f9ae58a78c , < f7415e60c25a6108cd7955a20b2e66b6251ffe02 (git)
Affected: 3953ae7b218df4d1e544b98a393666f9ae58a78c , < 24256415d18695b46da06c93135f5b51c548b950 (git)
Affected: b102bfc2a90d14f342580285782a9a51c74f7369 (git)
Affected: 10c15ddabbcf888922adbdd44ca3fecf6eab19d9 (git)
Affected: 8d1c650d452c53fcb3f02a7b1d772741639f89a4 (git)
Affected: 12b5fb58ac993c24210cf8cbc72d407d3a4e6490 (git)
Affected: aef37401b467a0b1a9517c69924a1d66937e0789 (git)
Affected: 3.2.99 , < 3.3 (semver)
Affected: 3.16.54 , < 3.17 (semver)
Affected: 4.4.225 , < 4.5 (semver)
Affected: 4.9.225 , < 4.10 (semver)
Affected: 4.14.182 , < 4.15 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 6.11.3 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49940",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:37:52.827630Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:38:50.656Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/l2tp/l2tp_core.c",
            "net/l2tp/l2tp_core.h",
            "net/l2tp/l2tp_netlink.c",
            "net/l2tp/l2tp_ppp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7415e60c25a6108cd7955a20b2e66b6251ffe02",
              "status": "affected",
              "version": "3953ae7b218df4d1e544b98a393666f9ae58a78c",
              "versionType": "git"
            },
            {
              "lessThan": "24256415d18695b46da06c93135f5b51c548b950",
              "status": "affected",
              "version": "3953ae7b218df4d1e544b98a393666f9ae58a78c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b102bfc2a90d14f342580285782a9a51c74f7369",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "10c15ddabbcf888922adbdd44ca3fecf6eab19d9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8d1c650d452c53fcb3f02a7b1d772741639f89a4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "12b5fb58ac993c24210cf8cbc72d407d3a4e6490",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "aef37401b467a0b1a9517c69924a1d66937e0789",
              "versionType": "git"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.99",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.54",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.225",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.225",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.182",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/l2tp/l2tp_core.c",
            "net/l2tp/l2tp_core.h",
            "net/l2tp/l2tp_netlink.c",
            "net/l2tp/l2tp_ppp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.99",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.225",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.225",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.182",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: prevent possible tunnel refcount underflow\n\nWhen a session is created, it sets a backpointer to its tunnel. When\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\nrefcount if session-\u003etunnel is non-NULL. However, session-\u003etunnel is\nset in l2tp_session_create, before the tunnel refcount is incremented\nby l2tp_session_register, which leaves a small window where\nsession-\u003etunnel is non-NULL when the tunnel refcount hasn\u0027t been\nbumped.\n\nMoving the assignment to l2tp_session_register is trivial but\nl2tp_session_create calls l2tp_session_set_header_len which uses\nsession-\u003etunnel to get the tunnel\u0027s encap. Add an encap arg to\nl2tp_session_set_header_len to avoid using session-\u003etunnel.\n\nIf l2tpv3 sessions have colliding IDs, it is possible for\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\nsession which doesn\u0027t yet have session-\u003etunnel set. Add a check for\nthis case."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The refcount underflow is triggered by local session creation \u2014 either the L2TP generic-netlink `L2TP_CMD_SESSION_CREATE` command or a `connect()` on an `AF_PPPOX`/`PX_PROTO_OL2TP` socket. A remote peer cannot itself drive `l2tp_session_create()`/`l2tp_session_register()`, though remote packets in `l2tp_udp_encap_recv()` are what subsequently dereference the prematurely freed tunnel.\nAC:L - The attacker fully controls both sides: they choose the session ID, so they can deterministically force `l2tp_session_register()` to fail (`-EEXIST` on a colliding L2TPv3 ID, or `-ENODEV`), and they can run concurrent create/teardown threads to widen the window between `l2tp_session_create()` and the tunnel refcount bump. No condition outside attacker influence is required, and L2TP is a stock distro module.\nPR:L - `pppol2tp_create()`/`pppox_create()` perform no capability check, so a plain unprivileged local user can reach `l2tp_session_create()` and `l2tp_session_register()` through `connect()`. The netlink path is `GENL_UNS_ADMIN_PERM` (CAP_NET_ADMIN against the netns user_ns), which any unprivileged user obtains via `unshare -Urn`.\nUI:N - The attacker performs the entire sequence \u2014 tunnel setup, session creation with a colliding ID, and session teardown \u2014 from their own process. No victim action or cooperating user is involved.\nS:U - The underflow and the resulting use-after-free are confined to the kernel\u0027s own l2tp objects within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The dropped-too-early tunnel reference frees `struct l2tp_tunnel` while `session-\u003etunnel` and the datapath still reference it, giving a use-after-free on a kmalloc\u0027d object that can be reclaimed with attacker-sprayed data and then read back (e.g. `tunnel-\u003esock`, `tunnel-\u003eencap`, `tunnel-\u003eversion` used in `l2tp_recv_common()`/`l2tp_xmit_skb()`), enabling kernel memory disclosure.\nI:H - A use-after-free on the tunnel object lets an attacker reoccupy the freed slab and control fields such as `tunnel-\u003esock`, which the transmit and receive paths dereference and pass to socket operations, yielding a write/control-flow-hijack primitive. Additionally the extra `l2tp_tunnel_dec_refcount()` corrupts kernel reference-counting state itself.\nA:H - Premature tunnel free reliably produces an oops/panic when the still-live session or a received L2TP packet dereferences the dangling `session-\u003etunnel`, and the `refcount_t` underflow itself raises a WARN that panics on `panic_on_warn` systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:35.425Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02"
        },
        {
          "url": "https://git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950"
        }
      ],
      "title": "l2tp: prevent possible tunnel refcount underflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49940",
    "datePublished": "2024-10-21T18:01:59.668Z",
    "dateReserved": "2024-10-21T12:17:06.043Z",
    "dateUpdated": "2026-08-05T11:40:35.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49940",
      "date": "2026-09-16",
      "epss": "0.00238",
      "percentile": "0.15022"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.11.3\", \"matchCriteriaId\": \"6D5FF9C2-A011-4A64-B614-F9244ED2EA0D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nl2tp: prevent possible tunnel refcount underflow\\n\\nWhen a session is created, it sets a backpointer to its tunnel. When\\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\\nrefcount if session-\u003etunnel is non-NULL. However, session-\u003etunnel is\\nset in l2tp_session_create, before the tunnel refcount is incremented\\nby l2tp_session_register, which leaves a small window where\\nsession-\u003etunnel is non-NULL when the tunnel refcount hasn\u0027t been\\nbumped.\\n\\nMoving the assignment to l2tp_session_register is trivial but\\nl2tp_session_create calls l2tp_session_set_header_len which uses\\nsession-\u003etunnel to get the tunnel\u0027s encap. Add an encap arg to\\nl2tp_session_set_header_len to avoid using session-\u003etunnel.\\n\\nIf l2tpv3 sessions have colliding IDs, it is possible for\\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\\nsession which doesn\u0027t yet have session-\u003etunnel set. Add a check for\\nthis case.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: l2tp: evitar un posible desbordamiento del recuento de referencias del t\\u00fanel Cuando se crea una sesi\\u00f3n, establece un puntero hacia atr\\u00e1s a su t\\u00fanel. Cuando el recuento de referencias de la sesi\\u00f3n cae a 0, l2tp_session_free descarta el recuento de referencias del t\\u00fanel si session-\u0026gt;tunnel no es NULL. Sin embargo, session-\u0026gt;tunnel se establece en l2tp_session_create, antes de que el recuento de referencias del t\\u00fanel se incremente mediante l2tp_session_register, lo que deja una peque\\u00f1a ventana donde session-\u0026gt;tunnel no es NULL cuando el recuento de referencias del t\\u00fanel no se ha incrementado. Mover la asignaci\\u00f3n a l2tp_session_register es trivial, pero l2tp_session_create llama a l2tp_session_set_header_len, que usa session-\u0026gt;tunnel para obtener el encap del t\\u00fanel. Agregue un argumento de encap a l2tp_session_set_header_len para evitar usar session-\u0026gt;tunnel. Si las sesiones l2tpv3 tienen identificadores en conflicto, es posible que l2tp_v3_session_get compita con l2tp_session_register y obtenga una sesi\\u00f3n que a\\u00fan no tenga configurado session-\u0026gt;tunnel. Agregue una verificaci\\u00f3n para este caso.\"}]",
      "id": "CVE-2024-49940",
      "lastModified": "2024-11-13T13:26:01.343",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T18:15:15.703",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:55:33.000Z",
      "cve": "CVE-2024-49940",
      "id": "msrc_CVE-2024-49940",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:under_investigation": "19",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "l2tp: prevent possible tunnel refcount underflow",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-49940.json",
      "version": "14"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49940\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:15.703\",\"lastModified\":\"2026-08-04T11:21:00.160\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nl2tp: prevent possible tunnel refcount underflow\\n\\nWhen a session is created, it sets a backpointer to its tunnel. When\\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\\nrefcount if session-\u003etunnel is non-NULL. However, session-\u003etunnel is\\nset in l2tp_session_create, before the tunnel refcount is incremented\\nby l2tp_session_register, which leaves a small window where\\nsession-\u003etunnel is non-NULL when the tunnel refcount hasn\u0027t been\\nbumped.\\n\\nMoving the assignment to l2tp_session_register is trivial but\\nl2tp_session_create calls l2tp_session_set_header_len which uses\\nsession-\u003etunnel to get the tunnel\u0027s encap. Add an encap arg to\\nl2tp_session_set_header_len to avoid using session-\u003etunnel.\\n\\nIf l2tpv3 sessions have colliding IDs, it is possible for\\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\\nsession which doesn\u0027t yet have session-\u003etunnel set. Add a check for\\nthis case.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: l2tp: evitar un posible desbordamiento del recuento de referencias del t\u00fanel Cuando se crea una sesi\u00f3n, establece un puntero hacia atr\u00e1s a su t\u00fanel. Cuando el recuento de referencias de la sesi\u00f3n cae a 0, l2tp_session_free descarta el recuento de referencias del t\u00fanel si session-\u0026gt;tunnel no es NULL. Sin embargo, session-\u0026gt;tunnel se establece en l2tp_session_create, antes de que el recuento de referencias del t\u00fanel se incremente mediante l2tp_session_register, lo que deja una peque\u00f1a ventana donde session-\u0026gt;tunnel no es NULL cuando el recuento de referencias del t\u00fanel no se ha incrementado. Mover la asignaci\u00f3n a l2tp_session_register es trivial, pero l2tp_session_create llama a l2tp_session_set_header_len, que usa session-\u0026gt;tunnel para obtener el encap del t\u00fanel. Agregue un argumento de encap a l2tp_session_set_header_len para evitar usar session-\u0026gt;tunnel. Si las sesiones l2tpv3 tienen identificadores en conflicto, es posible que l2tp_v3_session_get compita con l2tp_session_register y obtenga una sesi\u00f3n que a\u00fan no tenga configurado session-\u0026gt;tunnel. Agregue una verificaci\u00f3n para este caso.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/l2tp/l2tp_core.c\",\"net/l2tp/l2tp_core.h\",\"net/l2tp/l2tp_netlink.c\",\"net/l2tp/l2tp_ppp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3953ae7b218df4d1e544b98a393666f9ae58a78c\",\"lessThan\":\"f7415e60c25a6108cd7955a20b2e66b6251ffe02\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3953ae7b218df4d1e544b98a393666f9ae58a78c\",\"lessThan\":\"24256415d18695b46da06c93135f5b51c548b950\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b102bfc2a90d14f342580285782a9a51c74f7369\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"10c15ddabbcf888922adbdd44ca3fecf6eab19d9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8d1c650d452c53fcb3f02a7b1d772741639f89a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"12b5fb58ac993c24210cf8cbc72d407d3a4e6490\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"aef37401b467a0b1a9517c69924a1d66937e0789\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.2.99\",\"lessThan\":\"3.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.16.54\",\"lessThan\":\"3.17\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.4.225\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.225\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.182\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/l2tp/l2tp_core.c\",\"net/l2tp/l2tp_core.h\",\"net/l2tp/l2tp_netlink.c\",\"net/l2tp/l2tp_ppp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.3\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:37:52.827630Z\",\"id\":\"CVE-2024-49940\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"6D5FF9C2-A011-4A64-B614-F9244ED2EA0D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T15:08:07+00:00",
      "cve": "CVE-2024-49940",
      "id": "CVE-2024-49940",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: l2tp: prevent possible tunnel refcount underflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49940.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:12:31Z",
      "cve": "CVE-2024-49940",
      "id": "CVE-2024-49940",
      "initial_release_date": "2024-11-06T03:50:01Z",
      "product_status:known_affected": "826",
      "product_status:known_not_affected": "34",
      "product_status:recommended": "325",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-49940",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49940.json",
      "version": "77"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49940\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:37:52.827630Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:37:56.128Z\"}}], \"cna\": {\"title\": \"l2tp: prevent possible tunnel refcount underflow\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3953ae7b218df4d1e544b98a393666f9ae58a78c\", \"lessThan\": \"f7415e60c25a6108cd7955a20b2e66b6251ffe02\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3953ae7b218df4d1e544b98a393666f9ae58a78c\", \"lessThan\": \"24256415d18695b46da06c93135f5b51c548b950\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b102bfc2a90d14f342580285782a9a51c74f7369\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"10c15ddabbcf888922adbdd44ca3fecf6eab19d9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8d1c650d452c53fcb3f02a7b1d772741639f89a4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"12b5fb58ac993c24210cf8cbc72d407d3a4e6490\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"aef37401b467a0b1a9517c69924a1d66937e0789\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3.2.99\", \"lessThan\": \"3.3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.16.54\", \"lessThan\": \"3.17\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.4.225\", \"lessThan\": \"4.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.9.225\", \"lessThan\": \"4.10\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.14.182\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/l2tp/l2tp_core.c\", \"net/l2tp/l2tp_core.h\", \"net/l2tp/l2tp_netlink.c\", \"net/l2tp/l2tp_ppp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/l2tp/l2tp_core.c\", \"net/l2tp/l2tp_core.h\", \"net/l2tp/l2tp_netlink.c\", \"net/l2tp/l2tp_ppp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02\"}, {\"url\": \"https://git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nl2tp: prevent possible tunnel refcount underflow\\n\\nWhen a session is created, it sets a backpointer to its tunnel. When\\nthe session refcount drops to 0, l2tp_session_free drops the tunnel\\nrefcount if session-\u003etunnel is non-NULL. However, session-\u003etunnel is\\nset in l2tp_session_create, before the tunnel refcount is incremented\\nby l2tp_session_register, which leaves a small window where\\nsession-\u003etunnel is non-NULL when the tunnel refcount hasn\u0027t been\\nbumped.\\n\\nMoving the assignment to l2tp_session_register is trivial but\\nl2tp_session_create calls l2tp_session_set_header_len which uses\\nsession-\u003etunnel to get the tunnel\u0027s encap. Add an encap arg to\\nl2tp_session_set_header_len to avoid using session-\u003etunnel.\\n\\nIf l2tpv3 sessions have colliding IDs, it is possible for\\nl2tp_v3_session_get to race with l2tp_session_register and fetch a\\nsession which doesn\u0027t yet have session-\u003etunnel set. Add a check for\\nthis case.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.2.99\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.16.54\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.4.225\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.9.225\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.14.182\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:54:05.584Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49940\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:54:05.584Z\", \"dateReserved\": \"2024-10-21T12:17:06.043Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:01:59.668Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.