CVE-2024-49940: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's Layer 2 Tunneling Protocol (L2TP) implementation was discovered and resolved. The issue involves a potential tunnel refcount underflow condition that occurs during session creation. The vulnerability affects Linux kernel versions up to (excluding) 6.11.3 (NVD).

The vulnerability stems from a race condition in the session creation process. When a session is created, it sets a backpointer to its tunnel, but the tunnel refcount is incremented by l2tp_session_register after session->tunnel is set in l2tp_session_create. This creates a window where session->tunnel is non-NULL when the tunnel refcount hasn't been incremented. Additionally, for l2tpv3 sessions with colliding IDs, l2tp_v3_session_get could race with l2tp_session_register and fetch a session before session->tunnel is properly set. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (NVD).

The vulnerability could lead to a tunnel refcount underflow condition, potentially causing system instability or denial of service. The impact is limited to local attacks and primarily affects system availability, with no direct impact on confidentiality or integrity (NVD).

The vulnerability has been patched in the Linux kernel. The fix involves moving the tunnel assignment to l2tp_session_register and adding an encap argument to l2tp_session_set_header_len to avoid using session->tunnel. Additional checks have been implemented for l2tpv3 session handling to prevent the race condition (Kernel Patch).