{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "0e0c3fee3a59a387aeecc4fca6f3a2e9615a5443"
            },
            {
              "fixed": "ebe2774e956482dd3c70b8991f6f7654356339e6"
            },
            {
              "fixed": "9006c116dd111d457bf5d074990210f70a4ad2c8"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "f6104e9ae04462523c372928b1173766a771ef95"
            },
            {
              "last_affected": "7f8e401f9e612df2a95c1ef76217c00181389bb5"
            },
            {
              "last_affected": "c712ed63e9b33d9a282fbd92ce25c64918c3129f"
            },
            {
              "last_affected": "9a8863e8a8def9d88583cd9c60db38a008e6b8cf"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "3.16.60"
            },
            {
              "fixed": "3.17"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "4.16.6"
            },
            {
              "fixed": "4.17"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.17.0"
            },
            {
              "fixed": "7.1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74735.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: fix tunnel and session refcount leak on seq_file release\n\nIn pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state\n(pd-\u003etunnel and pd-\u003esession) is kept in seq_file private data to allow\niteration across multiple read() system calls.\n\nHowever, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels\nbefore reading to end-of-file (EOF), any tunnel or session reference stored in\npd-\u003etunnel / pd-\u003esession is left un-dropped when seq_file private data is freed.\n\nFix this by dropping any remaining pd-\u003etunnel and pd-\u003esession references in\npppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file.",
  "id": "CVE-2026-74735",
  "modified": "2026-08-28T11:30:56.518522827Z",
  "published": "2026-08-26T14:36:49.352Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9006c116dd111d457bf5d074990210f70a4ad2c8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ebe2774e956482dd3c70b8991f6f7654356339e6"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74735.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74735"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "l2tp: fix tunnel and session refcount leak on seq_file release"
}