EUVD-2026-80310
GHSA-h6q8-7j67-4q68
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only kernel bug (AV:L); race condition requiring a narrow error-path window and concurrent softirq packet makes AC:H; GTP link creation needs CAP_NET_ADMIN so PR:L; UAF yields full kernel-memory C/I/A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
gtp_newlink()'s error path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing sk_user_data. A concurrent gtp_encap_recv() in softirq may still hold the gtp_dev pointer obtained via rcu_dereference_sk_user_data() and access the freed memory.
BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152) Call Trace: <IRQ> gtp0_pdp_find+0x1f6/0x200 gtp_encap_recv+0x527/0x24b0 udp_queue_rcv_one_skb+0x75f/0xc10
Add synchronize_net() before the kfree calls in out_hashtable, which covers all error paths from both gtp_encap_enable() and gtp_create_sockets().
AnalysisAI
A use-after-free in the Linux kernel GTP (GPRS Tunnelling Protocol) module allows a local attacker who can create GTP links to trigger a race between link teardown and inbound packet processing, potentially leading to kernel memory corruption with high confidentiality, integrity, and availability impact. Only systems that have the gtp module loaded or reachable are exposed - a mobile-core/telecom feature uncommon in general-purpose Linux deployments - and exploitation requires CAP_NET_ADMIN (obtainable by an unprivileged user within a user namespace) plus a non-deterministic race win, which is why our independent assessment rates the vector AV:L/AC:H/PR:L rather than the published AV:L/AC:L/PR:L. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the kernel gtp module to be loaded/reachable - a telecom/mobile-core feature not present in typical deployments; (2) local access with CAP_NET_ADMIN to create GTP netlink links via gtp_newlink() (attainable by an unprivileged user inside a user namespace); (3) triggering the gtp_newlink() error path (via gtp_encap_enable()/gtp_create_sockets() failure) so tid_hash/addr_hash are freed without an RCU grace period; and (4) a concurrent inbound GTP UDP packet processed in softirq (gtp_encap_recv → gtp0_pdp_find) that still holds the RCU-dereferenced gtp_dev pointer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a Linux kernel use-after-free (CWE-416; CWE field marked N/A in input) in the GTP module's gtp_newlink() error path, confirmed by a KASAN slab-use-after-free report in gtp0_pdp_find and a vendor patch. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to the fixed stable kernel for your branch - Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110 or 6.18.52 (7.2.6 and 7.3-rc1 for the newer lines) - or apply the upstream stable commit corresponding to your tree (fcafb2b1430824bae4258c01a439ec97ca0c6973, 3ca3da5c305caa873ddb81e8c6b118143f6dd3d1, 6f815c2fb6ab20385f81c353cdad0ea3b88132af, e3b9aa0773abd5d4ed90be41ce5306c146d5b09e, fd8396cfecbd904468c71362f08aaa25f96d5337, 7677eb2cbf2cc7446de474c01a6b06277c0051e5, 8d85498016a5bb56339734a14c276209fa65bafc, d989e22ae9802c52c56ad4284d0caf26696cf6ae), which inserts synchronize_net() before the hashtable kfree calls in the gtp_newlink() out_hashtable path; see https://git.kernel.org/stable/c/fcafb2b1430824bae4258c01a439ec97ca0c6973 and https://nvd.nist.gov/vuln/detail/CVE-2026-89789. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify which hosts load or expose the kernel GTP module - typically mobile-core, GTP proxy, and telecom packet-gateway systems rather than general-purpose servers - and confirm whether an unprivileged user namespace path could grant CAP_NET_ADMIN on those hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today