Public bug reported:
Since upgrading from linux-image 6.8.0-142-generic to 6.8.0-146-generic (Ubuntu
24.04 noble),
every connection of an L2TP/IPsec VPN (NetworkManager-l2tp + strongSwan +
xl2tpd, kernel L2TP mode)
immediately triggers three refcount_t warnings in l2tp_core. The system then
hard-freezes
(no further log output, power cycle required).
Observed twice on 2026-10-02:
- Boot 1: VPN connected 08:38:48 -> refcount warnings at the same second; VPN
disconnected 09:29;
machine froze at 09:49 while entering s2idle suspend (log ends after
"Filesystems sync").
- Boot 2: VPN connected 10:23:55 -> refcount warnings at the same second;
machine froze ~5 s later.
With 6.8.0-142-generic the same VPN connected twice on 2026-10-01 without any
warnings.
Booting 6.8.0-142 is the current workaround.
**Update: still present in 6.8.0-147.147** (contains CVE-2026-68398 "ppp: defer
channel free to an RCU
grace period to fix pppol2tp RX UAF", which does not fix this). See section
"6.8.0-147" below.
Possibly related (same refcount_inc vs refcount_inc_not_zero pattern in l2tp
session lookup):
CVE-2026-63918 "l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname".
Here, however, the
failing path is l2tp_tunnel_get_session() via xfrm_trans_reinject (ESP-in-UDP
decap).
### Steps to reproduce
1. Boot 6.8.0-146-generic.
2. Connect an L2TP/IPsec VPN via NetworkManager (network-manager-l2tp, kernel
L2TP support).
3. Watch `journalctl -k`: refcount_t warnings appear immediately. The system
freezes shortly after
(seconds to about one hour).
### Expected
VPN works as with 6.8.0-142, no refcount warnings, no freeze.
### Environment
- Hardware: Lenovo ThinkPad X1 Carbon 6th gen (20KGS27V0P), BIOS N23ET90W
(1.65) 11/07/2024
- Kernel: Ubuntu 6.8.0-146.146-generic 6.8.12 (good: 6.8.0-142.142)
- strongswan 5.9.13-2ubuntu4.24.04.5, xl2tpd 1.3.18-1build2,
network-manager-l2tp 1.20.16-1~ubuntu22.04.1~ppa1.1
### Kernel log (first of three warnings; the other two follow within the
same second)
```
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 3 PID: 13592 at lib/refcount.c:25
refcount_warn_saturate+0x12e/0x150
Modules linked in: authenc echainiv esp4 xfrm_interface xfrm6_tunnel tunnel4
tunnel6 xfrm_user xfrm_algo l2tp_ppp l2tp_netlink l2tp_core ip6_udp_tunnel
udp_tunnel pppox ccm ... (truncated)
CPU: 3 PID: 13592 Comm: kworker/3:2 Not tainted 6.8.0-146-generic #146-Ubuntu
Hardware name: LENOVO 20KGS27V0P/20KGS27V0P, BIOS N23ET90W (1.65 ) 11/07/2024
Workqueue: events xfrm_trans_reinject
RIP: 0010:refcount_warn_saturate+0x12e/0x150
Call Trace:
<TASK>
l2tp_tunnel_get_session+0xc8/0xd0 [l2tp_core]
l2tp_udp_recv_core+0xb1/0x350 [l2tp_core]
? __pfx_l2tp_udp_encap_recv+0x10/0x10 [l2tp_core]
l2tp_udp_encap_recv+0x2c/0x54 [l2tp_core]
udp_queue_rcv_one_skb+0x278/0x550
udp_queue_rcv_skb+0x4f/0x80
udp_unicast_rcv_skb+0x7a/0xa0
__udp4_lib_rcv+0x627/0x6f0
udp_rcv+0x25/0x40
ip_protocol_deliver_rcu+0xd8/0x210
ip_local_deliver_finish+0x77/0xa0
ip_local_deliver+0x6e/0x120
xfrm4_rcv_encap_finish2+0x3c/0x60
xfrm_trans_reinject+0xe2/0x170
process_one_work+0x181/0x3a0
worker_thread+0x18b/0x330
kthread+0xef/0x120
ret_from_fork+0x44/0x70
ret_from_fork_asm+0x1b/0x30
</TASK>
---[ end trace 0000000000000000 ]---
```
Followed by:
- `refcount_t: underflow; use-after-free.` in
`l2tp_session_dec_refcount+0xbb/0xd0 [l2tp_core]` <- `l2tp_udp_recv_core+0x103`
- `refcount_t: saturated; leaking memory.` in
`l2tp_tunnel_get_session+0xbc/0xd0 [l2tp_core]` <- `l2tp_udp_recv_core+0xb1`
(same xfrm_trans_reinject -> l2tp_udp_encap_recv call chain)
## 6.8.0-147: same bug, followed by memory corruption and soft lockup
(2026-10-16)
Timeline (single boot, 6.8.0-147-generic #147-Ubuntu):
- 11:30:15 NetworkManager starts "VPN Oberlin" (l2tp), 11:30:21 ppp0 up.
- 11:30:20 identical three refcount_t warnings (addition on 0 / underflow /
saturated) in
l2tp_tunnel_get_session / l2tp_session_dec_refcount, same xfrm_trans_reinject
-> l2tp_udp_encap_recv
call chain as on 146 (kworker/3:3, PID 3379, Workqueue: events
xfrm_trans_reinject).
- 11:46:36 general protection fault, non-canonical address 0xca9155eafb9a38f2,
in an unrelated
path (i915_gem_create_context <- i915_gem_context_lookup <-
i915_gem_execbuffer2_ioctl, comm
gnome-character), followed by further oopses in snapd/evolution -> looks like
memory corruption from
the use-after-free.
- 11:47:00 onwards: "watchdog: BUG: soft lockup - CPU#3 stuck for 26s!
[kworker/3:3:3379]",
repeated 20 times up to "stuck for 555s"; RIP:
l2tp_tunnel_get_session+0x3d/0xd0 [l2tp_core]
(looping in the session hash list walk, list apparently corrupted).
- Effect: desktop still visible, but no new programs could be started; reboot
hung; hard power-off needed.
Soft lockup trace (first occurrence):
```
watchdog: BUG: soft lockup - CPU#3 stuck for 26s! [kworker/3:3:3379]
CPU: 3 PID: 3379 Comm: kworker/3:3 Tainted: G D W
6.8.0-147-generic #147-Ubuntu
Hardware name: LENOVO 20KGS27V0P/20KGS27V0P, BIOS N23ET90W (1.65 ) 11/07/2024
Workqueue: events xfrm_trans_reinject
RIP: 0010:l2tp_tunnel_get_session+0x3d/0xd0 [l2tp_core]
Call Trace:
<TASK>
l2tp_udp_recv_core+0xb1/0x350 [l2tp_core]
? __pfx_l2tp_udp_encap_recv+0x10/0x10 [l2tp_core]
l2tp_udp_encap_recv+0x2c/0x54 [l2tp_core]
udp_queue_rcv_one_skb+0x278/0x550
udp_queue_rcv_skb+0x4f/0x80
udp_unicast_rcv_skb+0x7a/0xa0
...
xfrm4_rcv_encap_finish2+0x3c/0x60
xfrm_trans_reinject+0xe2/0x170
process_one_work+0x181/0x3a0
worker_thread+0x18b/0x330
kthread+0xef/0x120
```
The first refcount warning on 147 is byte-identical in offsets to 146
(l2tp_tunnel_get_session+0xc8/0xd0, l2tp_udp_recv_core+0xb1/0x350).
Workaround remains: boot 6.8.0-142-generic.
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: linux-image-6.8.0-147-generic 6.8.0-147.147
ProcVersionSignature: Ubuntu 6.8.0-147.147-generic 6.8.12
Uname: Linux 6.8.0-147-generic x86_64
ApportVersion: 2.28.3-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: robert 2579 F.... wireplumber
/dev/snd/seq: robert 2576 F.... pipewire
CRDA: N/A
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Fri Oct 16 12:12:15 2026
InstallationDate: Installed on 2023-10-04 (1108 days ago)
InstallationMedia: Ubuntu 22.04.3 LTS "Jammy Jellyfish" - Release amd64
(20230807.2)
MachineType: LENOVO 20KGS27V0P
ProcEnviron:
LANG=de_DE.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-6.8.0-147-generic
root=UUID=8546b7b9-2121-4fdb-84b9-a449ef8398c5 ro quiet splash vt.handoff=7
RelatedPackageVersions:
linux-restricted-modules-6.8.0-147-generic N/A
linux-backports-modules-6.8.0-147-generic N/A
linux-firmware 20240318.git3b128b60.0ubuntu3.1
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 11/07/2024
dmi.bios.release: 1.65
dmi.bios.vendor: LENOVO
dmi.bios.version: N23ET90W (1.65 )
dmi.board.asset.tag: Not Available
dmi.board.name: 20KGS27V0P
dmi.board.vendor: LENOVO
dmi.board.version: SDK0J40697 WIN
dmi.chassis.asset.tag: 207734
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: None
dmi.ec.firmware.release: 1.22
dmi.modalias:
dmi:bvnLENOVO:bvrN23ET90W(1.65):bd11/07/2024:br1.65:efr1.22:svnLENOVO:pn20KGS27V0P:pvrThinkPadX1Carbon6th:rvnLENOVO:rn20KGS27V0P:rvrSDK0J40697WIN:cvnLENOVO:ct10:cvrNone:skuLENOVO_MT_20KG_BU_Think_FM_ThinkPadX1Carbon6th:
dmi.product.family: ThinkPad X1 Carbon 6th
dmi.product.name: 20KGS27V0P
dmi.product.sku: LENOVO_MT_20KG_BU_Think_FM_ThinkPad X1 Carbon 6th
dmi.product.version: ThinkPad X1 Carbon 6th
dmi.sys.vendor: LENOVO
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble wayland-session
** Attachment added: "kernel_log_6.8.0-147_2026-10-16.txt.gz"
https://bugs.launchpad.net/bugs/2171060/+attachment/6009715/+files/kernel_log_6.8.0-147_2026-10-16.txt.gz
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171060
Title:
l2tp_core: refcount_t "addition on 0; use-after-free" in
l2tp_tunnel_get_session on every L2TP/IPsec connect, system freezes
(regression 6.8.0-142 -> 6.8.0-146, still present in 6.8.0-147, noble)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2171060/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
