CVE-2026-23120: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23120 is a data-race vulnerability in the Linux kernel's L2TP (Layer 2 Tunneling Protocol) implementation within the l2tp_tunnel_del_work() function. The flaw arises because sk->sk_socket is read without proper synchronization when handling kernel sockets, creating a race condition with sk_common_release(). It was published on February 14, 2026, and affects multiple Linux kernel versions ranging from 3.16.57 through 6.18.7, as well as 6.19 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a concurrent read/write data race (CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization) in the Linux kernel's L2TP subsystem. Specifically, l2tp_tunnel_del_work() reads sk->sk_socket without holding the appropriate lock, while sk_common_release() concurrently writes to the same memory location via sock_orphan(). The race was originally detected by syzbot (the Linux kernel fuzzer), which reported the KCSAN data-race between these two code paths. Exploitation requires a local attacker to trigger concurrent L2TP tunnel deletion and socket cleanup operations (Feedly).

Successful exploitation can cause kernel instability or a system crash, resulting in a denial of service (availability impact: High). Because the vulnerability involves unsynchronized access to kernel socket structures, it may also lead to memory corruption in affected kernel versions. Confidentiality and integrity are not directly impacted; the primary risk is system availability for any Linux host running an affected kernel version with L2TP in use (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability requires local access with low privileges to trigger, limiting its attack surface. The EPSS score is approximately 0.024% (0.000240), reflecting a very low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Patches have been released for all affected stable kernel branches. Fixed versions include: 3.17+, 4.16+, 5.10.249+, 5.15.199+, 6.1.162+, 6.6.122+, 6.12.68+, and 6.18.8+. Patch commits are available at git.kernel.org for each stable branch. Administrators should apply the latest stable kernel update for their distribution (Ubuntu USN-8162-1, USN-8180-x, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1; SUSE SUSE-SU-2026:1661-1, SUSE-SU-2026:1668-1; Oracle ELSA-2026-50160, ELSA-2026-50232) as soon as possible, and restrict local system access to trusted users where feasible (Feedly, Ubuntu USN-8180, SUSE Advisory).