kernel: l2tp: Race condition between pppol2tp_session_create() and l2tp_eth_create()
A race condition between pppol2tpsessioncreate and l2tpethcreate in net/l2tp/l2tpnetlink.c was found in the Linux kernel. Calling l2tptunnelfind may result in a new tunnel being created with tunnel id of a previously removed tunnel which wouldn't be protected by the reference counter...