CVE-2026-64119

CVE-2026-64119 affects the Linux kernel L2TP subsystem. A local unprivileged user can pin the host CPU indefinitely by racing L2TP_CMD_SESSION_GET on L2TP_ATTR_IFNAME with L2TP_CMD_SESSION_CREATE/DELETE on the same tunnel, under CAP_NET_ADMIN. The root cause is list_del_init() in l2tp_session_unh...