diff --git a/net-dialup/xl2tpd/Manifest b/net-dialup/xl2tpd/Manifest
index b109b79e685d3..b30dd6056150b 100644
--- a/net-dialup/xl2tpd/Manifest
+++ b/net-dialup/xl2tpd/Manifest
@@ -1,3 +1,4 @@
 DIST xl2tpd-1.3.18-r2-Pass-remotenumber-to-pppd.patch 4074 BLAKE2B d1566a22c51dfc448df41424722571206dbedb36b48bafe19a629b5c0c3eadce17a899d387c5aa241f4367cbfef86f09322f4a7dd429eeb1fd82539a81f7aa76 SHA512 8a10ddfbb6998a4caeaf8a55334d5e4a3fdbe10e0b71652699fda5bb27cd8f1e0b88c7dd50fb95cea3385353b91a4d9208003e436cc3d4e8023828a80cbbeb19
+DIST xl2tpd-1.3.20-ditch-select-use-poll-v2.patch 24434 BLAKE2B fdcea3f34c0d7fd9a1ce9934eda825a89d20a9c7254247fd9e55e68f26a3ea3870919b292966a10967e2ebcaed253ade01d90e88d567d8b6a432b2a99ae1d5dc SHA512 86c3151adab74ffc89ac55b15d728632ac41fe2db7e2767ed6f80dd5627fef55c1d3c44aac844e5403d8f5f5afd8069e3d2b648494b52264c4f4cf5163396533
 DIST xl2tpd-1.3.20-ditch-select-use-poll.patch 24347 BLAKE2B 8a13a52fb64a8135ccb4ccb618039c9345cccc28f31c08c58349e98b739994c7eddbfa629d1d4c79646e2060aef4cf1331ee57864413f16e105edd275768ce8b SHA512 bcfe9d0f90b8332078221e921307ca111eb3b0ed5c6b11716fc13f5bf9223ea58a667d46f38f8fdc3d062f596533da8550e5fb9312f0b6fefd9f799bf2a21407
 DIST xl2tpd-1.3.20.tar.gz 537558 BLAKE2B 98a5c0c6884aa77fe277ffc8a2310a472d5a5db86d39a4ae7da9f97eed53e033b6680a683b1bb52433320711f966ec1f3f02174ce15fbe52fb88d8287a1f8231 SHA512 d227e1dafbb1d7ca64d42084397eaf013f89958bc705d602ca9717e355b2a420756ccbf71663f920b44a6624411a59bf52fd039ba50a7d45a976e9af03ed4dc5
diff --git a/net-dialup/xl2tpd/files/xl2tpd-1.3.20-r2-Fix-use-after-free-in-child_handler.patch b/net-dialup/xl2tpd/files/xl2tpd-1.3.20-r2-Fix-use-after-free-in-child_handler.patch
new file mode 100644
index 0000000000000..8add2c8a0f58f
--- /dev/null
+++ b/net-dialup/xl2tpd/files/xl2tpd-1.3.20-r2-Fix-use-after-free-in-child_handler.patch
@@ -0,0 +1,64 @@
+https://github.com/xelerance/xl2tpd/pull/288
+From 0bfd157fe69996a64b7a48dff4b92d6604cbb560 Mon Sep 17 00:00:00 2001
+From: Jaco Kroon <jaco@uls.co.za>
+Date: Mon, 22 Jun 2026 12:35:49 +0200
+Subject: [PATCH] xl2tpd: Fix use-after-free in child_handler.
+
+==12749== Invalid write of size 4
+==12749==    at 0x4004D42: child_handler (xl2tpd.c:293)
+==12749==    by 0x4004D42: process_signal (xl2tpd.c:386)
+==12749==    by 0x400C843: network_thread (network.c:697)
+==12749==    by 0x4002A66: main (xl2tpd.c:1946)
+==12749==  Address 0x56bb9a0 is 480 bytes inside a block of size 4,944 free'd
+==12749==    at 0x486496F: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
+==12749==    by 0x4004D41: child_handler (xl2tpd.c:290)
+==12749==    by 0x4004D41: process_signal (xl2tpd.c:386)
+==12749==    by 0x400C843: network_thread (network.c:697)
+==12749==    by 0x4002A66: main (xl2tpd.c:1946)
+==12749==  Block was alloc'd at
+==12749==    at 0x48692B3: calloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
+==12749==    by 0x400B825: new_call (call.c:495)
+==12749==    by 0x4009020: message_type_avp (avp.c:323)
+==12749==    by 0x400AF76: handle_avps (avp.c:1771)
+==12749==    by 0x40085E3: handle_control (control.c:1822)
+==12749==    by 0x40085E3: handle_packet (control.c:1841)
+==12749==    by 0x400BEB1: network_thread_process_socket (network.c:617)
+==12749==    by 0x400C9F2: network_thread (network.c:761)
+==12749==    by 0x4002A66: main (xl2tpd.c:1946)
+==12749==
+
+When using kernel mode this call call_close, which will already
+close(c->fd) if >0 and destroy_call is actually called, including
+setting c->fd = -1.
+
+Further to be noted is that call_close could thus free() the relevant
+memory, resulting in this error.
+
+Bottom line:  We only need to set c->fd = -1 if we're the function closing the fd().
+
+Signed-off-by: Jaco Kroon <jaco@uls.co.za>
+---
+ xl2tpd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xl2tpd.c b/xl2tpd.c
+index cbf2e22..c1544f8 100644
+--- a/xl2tpd.c
++++ b/xl2tpd.c
+@@ -285,12 +285,12 @@ static void child_handler (int sig)
+ 
+ #endif
+                     close (c->fd);
++                    c->fd = -1;
+ #ifdef USE_KERNEL
+                  } else {
+                      call_close (c);
+                  }
+ #endif
+-                    c->fd = -1;
+                     /*
+                      * terminate tunnel and call loops, returning to the
+                      * for(;;) loop (and possibly get the next pid)
+-- 
+2.53.0
+
diff --git a/net-dialup/xl2tpd/xl2tpd-1.3.20-r2.ebuild b/net-dialup/xl2tpd/xl2tpd-1.3.20-r2.ebuild
new file mode 100644
index 0000000000000..f54de52f3f230
--- /dev/null
+++ b/net-dialup/xl2tpd/xl2tpd-1.3.20-r2.ebuild
@@ -0,0 +1,74 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit systemd toolchain-funcs tmpfiles
+
+DESCRIPTION="A modern version of the Layer 2 Tunneling Protocol (L2TP) daemon"
+HOMEPAGE="https://github.com/xelerance/xl2tpd"
+SRC_URI="
+	https://github.com/xelerance/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz
+	https://downloads.uls.co.za/patches/${PN}/${PN}-1.3.18-r2-Pass-remotenumber-to-pppd.patch
+	poll? ( https://downloads.uls.co.za/patches/${PN}/${PN}-1.3.20-ditch-select-use-poll-v2.patch )
+"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~x86"
+IUSE="+kernel poll"
+
+DEPEND="
+	net-libs/libpcap
+	>=sys-kernel/linux-headers-2.6"
+
+RDEPEND="
+	${DEPEND}
+	net-dialup/ppp"
+
+DOCS=( CREDITS README.md BUGS CHANGES TODO doc/README.patents )
+
+PATCHES=(
+	"${DISTDIR}/xl2tpd-1.3.18-r2-Pass-remotenumber-to-pppd.patch"
+	"${FILESDIR}/xl2tpd-1.3.20-r2-Fix-use-after-free-in-child_handler.patch"
+)
+
+src_prepare() {
+	default
+	use poll && eapply "${DISTDIR}/xl2tpd-1.3.20-ditch-select-use-poll-v2.patch"
+	sed -e 's:/var/run/:/run/:' -i \
+		file.h \
+		l2tp.h \
+		xl2tpd-control.c \
+		doc/l2tp-secrets.5 \
+		doc/xl2tpd.8 \
+		doc/xl2tpd.conf.5 \
+		|| die "Error updating /var/run to /run"
+}
+
+src_compile() {
+	tc-export CC
+	local OSFLAGS="-DLINUX"
+	use kernel && OSFLAGS+=" -DUSE_KERNEL"
+	emake OSFLAGS="${OSFLAGS}"
+}
+
+src_install() {
+	emake PREFIX=/usr DESTDIR="${D}" install
+
+	newinitd "${FILESDIR}"/xl2tpd-init-r1 xl2tpd
+
+	systemd_dounit "${FILESDIR}"/xl2tpd.service
+	dotmpfiles "${FILESDIR}"/xl2tpd.conf
+
+	einstalldocs
+
+	insinto /etc/xl2tpd
+	newins doc/l2tpd.conf.sample xl2tpd.conf
+	insopts -m 0600
+	newins doc/l2tp-secrets.sample l2tp-secrets
+}
+
+pkg_postinst() {
+	tmpfiles_process xl2tpd.conf
+}