The Linux kernel L2TP subsystem had a concurrency bug where l2tp_session_unhash() used list_del_init() to remove a session from tunnel->session_list, which is concurrently traversed under RCU read lock by l2tp_session_get_by_ifname(). The list_del_init() leaves the deleted entry's next/prev pointers self-pointing, causing the list traversal to loop indefinitely inside strcmp() with bottom halves and preemption disabled. This stalls RCU grace periods and wedges the CPU. The vulnerability can be triggered by an unprivileged local user with CAP_NET_ADMIN in a network namespace by issuing specific L2TP commands concurrently on the same tunnel. The fix replaces list_del_init() with list_del_rcu(), matching the existing list_add_rcu() usage and allowing safe concurrent traversal until the session is freed with kfree_rcu().

An unprivileged local user with CAP_NET_ADMIN in a network namespace can cause a host CPU to become indefinitely pinned (wedged), leading to denial of service on the affected system. The wedged thread cannot be killed immediately, and RCU grace periods stall, potentially impacting system responsiveness and stability.

A fix is available that replaces list_del_init() with list_del_rcu() in l2tp_session_unhash() to prevent the CPU hang. Users should apply the official Linux kernel patch that addresses this issue. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisory for the current patch availability and guidance.