Skip to main content

Linux Kernel EUVDEUVD-2026-53271

| CVE-2026-64577 HIGH
2026-08-05 Linux GHSA-cq6p-33cj-vghc
Information Disclosure Linux
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network attack (AV:N) via unauthenticated GTP-U UDP echo; single malformed packet triggers the bug with no complexity (AC:L, PR:N); pure kernel-panic DoS with no data exposure (C:N, I:N, A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 08, 2026 - 15:31 vuln.today
CVSS changed
Aug 08, 2026 - 15:22 NVD
7.5 (HIGH)
Patch available
Aug 05, 2026 - 09:01 EUVD
CVE Published
Aug 05, 2026 - 08:09 cve.org
HIGH 7.5
CVE Published
Aug 05, 2026 - 08:09 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

gtp1u_send_echo_resp() ignores skb_pull_data()'s return value. Its caller gtp1u_udp_encap_recv() only guarantees 16 bytes (udphdr + gtp1_header), but the pull requests 20 (gtp1_header_long + udphdr). For a 16-19 byte echo request the pull fails and returns NULL without advancing skb->data; execution continues, and the following skb_push() plus the IP header pushed by iptunnel_xmit() move skb->data below skb->head, tripping skb_under_panic().

Fix it by dropping the packet when skb_pull_data() fails.

skbuff: skb_under_panic: ... kernel BUG at net/core/skbuff.c:214! Call Trace: skb_push (net/core/skbuff.c:2648) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:82) gtp_encap_recv (drivers/net/gtp.c:701 drivers/net/gtp.c:808 drivers/net/gtp.c:920) udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) ... Kernel panic - not syncing: Fatal exception in interrupt

AnalysisAI

Remote kernel panic in the Linux kernel's GTP (GPRS Tunneling Protocol) driver allows an unauthenticated network attacker to crash a GTP-enabled host by sending a malformed echo request packet of 16-19 bytes. The vulnerability arises because gtp1u_send_echo_resp() ignores the NULL return from skb_pull_data() on an undersized buffer, causing skb->data to be pushed below skb->head by subsequent header operations, which trips skb_under_panic() and causes an immediate kernel BUG halt. No public exploit has been identified at time of analysis and EPSS of 0.18% (8th percentile) reflects low current exploitation probability, but the unauthenticated network-triggerable DoS against mobile core infrastructure warrants prompt patching for telecom operators.

Technical ContextAI

The flaw resides in drivers/net/gtp.c within the Linux kernel's GTP-U (GPRS Tunneling Protocol version 1 User-plane) driver. GTP-U runs over UDP port 2152 and forms the data plane for 3G/4G/5G mobile core networks. The receive path in gtp1u_udp_encap_recv() guarantees only 16 bytes (sizeof(udphdr) + sizeof(gtp1_header)) of available skb data, but gtp1u_send_echo_resp() calls skb_pull_data() requesting 20 bytes (sizeof(gtp1_header_long) + sizeof(udphdr)). When an echo request arrives with 16-19 bytes, skb_pull_data() fails and returns NULL without advancing skb->data. The function ignores this return value and continues execution; the subsequent skb_push() call combined with the IP header pushed by iptunnel_xmit() (net/ipv4/ip_tunnel_core.c:82) drives skb->data below skb->head, violating the SKB invariant enforced by a BUG() at net/core/skbuff.c:214. The root cause is effectively CWE-252 (Unchecked Return Value) leading to kernel panic. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* from commit 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 (introduced in Linux 5.18).

RemediationAI

Upgrade the Linux kernel to a patched stable release: 6.6.148 or later for the 6.6.x branch, 6.12.101 or later for the 6.12.x branch, 6.18.42 or later for the 6.18.x branch, 7.1.6 or later for the 7.1.x branch, or 7.2-rc5 or later for mainline. Upstream fix commits are available at https://git.kernel.org/stable/c/b3c733eaae7f362601c28ac1533d47a961cd3e1c and sibling stable commits for cherry-picking into custom or vendor kernels. For systems that cannot be immediately patched, two compensating controls exist with distinct trade-offs: (1) Block inbound UDP port 2152 at the network perimeter or host firewall - this eliminates remote exploitation but also disables GTP-U tunnel reception, making it viable only for non-GTP hosts; (2) Unload the GTP kernel module with 'modprobe -r gtp' - this eliminates the attack surface entirely with no functional impact on hosts not actively using GTP tunnels, but will break active GTP sessions on telecom gateway nodes. Distribution-specific kernel updates from vendors such as Red Hat, SUSE, Ubuntu, and Debian should be monitored for backported fixes to their respective LTS kernels.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

EUVD-2026-53271 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy