The vulnerability in the Linux kernel's L2TP subsystem arises from the use of list_del_init() in l2tp_session_unhash() to remove a session from tunnel->session_list. This list is concurrently traversed under RCU read lock by l2tp_session_get_by_ifname(). Because list_del_init() leaves the deleted entry's next/prev pointers self-referential, the list traversal loops indefinitely inside strcmp() with bottom halves and preemption disabled, causing the CPU to be pinned indefinitely. The attacker requires CAP_NET_ADMIN in the network namespace, achievable from an unprivileged sandbox with user namespaces. The fix replaces list_del_init() with list_del_rcu(), ensuring safe removal of the session from the list while maintaining consistent pointers for in-flight readers until the session is freed with kfree_rcu().

An unprivileged local user with CAP_NET_ADMIN in a network namespace can cause a host CPU to be pinned indefinitely, effectively causing a denial of service by stalling RCU grace periods and preventing the affected kernel thread from being killed promptly. There is no impact on confidentiality or integrity, but availability is severely affected.

A fix is available that replaces list_del_init() with list_del_rcu() in l2tp_session_unhash(). Users should update their Linux kernel to a version that includes this fix. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or distribution security advisories for the official patch and update instructions. Until patched, avoid running untrusted code with CAP_NET_ADMIN in user namespaces on hosts with the l2tp_core module loaded.