l2tp_tunnel_session_remove can be called twice when persistent option is used. Once from l2tp_session_tunnel_detach and during l2tp cleanup from l2tp_session_cleanup->l2tp_session_unlink later, that leads to poisoned hlist free attempt and SIGSEGV (most annoying outcome is that pid file is never unlinked).
l2tp_tunnel.c:
905 if (!usl_hlist_unhashed(hlist)) {
906 usl_hlist_del(hlist);
907 }
as usl_hlist_del fills hlist structure with poisoned values the condition in line 905 never evaluates properly. As persistent session can be reused (or l2tp_tunnel_session_remove can be called twice) usl_hlist_del_init call should be used instead (that has all needed checks internally). Please see patch attached.