CVE-2026-53262

Affected component: Linux kernel l2tp PPPoL2TP ioctl path. The vulnerability arises because pppol2tp_ioctl() read sock->sk->sk_user_data without locks or reference counting. A controllable sleep during copy_from_user (e.g., userfaultfd sleep) could allow a concurrent socket close to trigger...