A race condition between pppol2tp_session_create() and l2tp_eth_create() in net/l2tp/l2tp_netlink.c in the Linux kernel. Calling l2tp_tunnel_find() may result in a new tunnel being created with tunnel id of a previous removed tunnel which wouldn't be protected by the reference counter. https://nvd.nist.gov/vuln/detail/CVE-2018-9517
