Linux Foundation Magma EUVD-2026-68267

The targeted system must be running Linux Foundation Magma 1.9.0 with the AMF's NGSetupRequest Handler active and reachable. The attacker must have network-level access to the AMF N2 interface - in standard 3GPP-compliant deployments, this is a private SCTP interface exposed only to gNodeBs, not to the public internet. No authentication is required once network access is obtained (PR:N per CVSS 4.0 vector). The vulnerability does not require any special configuration beyond a standard Magma AMF deployment. Exploitation is limited to low availability impact (VA:L) with no confidentiality or integrity exposure; a successful attack causes handler disruption, not data exfiltration. The 'Information Disclosure' tag present in the source intelligence is inconsistent with the CVSS 4.0 vector (VC:N) and should not be treated as an accurate characterization of this vulnerability's impact.

The CVSS 4.0 score of 6.9 accurately reflects a moderate-severity vulnerability: network-accessible (AV:N), no privileges required (PR:N), no user interaction (UI:N), but limited to low availability impact on the vulnerable system only (VA:L) with no confidentiality or integrity exposure. The E:P modifier confirms a publicly available proof-of-concept exists, elevating practical risk above purely theoretical. The vulnerability has not been confirmed in CISA KEV, and EPSS data was not provided in the available intelligence, leaving exploitation probability unquantified from that signal. In standard 5G core deployments, the AMF N2 interface is expected to reside on a private network segment isolated from external actors, which significantly reduces real-world attack surface - however, operators with improperly segmented networks or who expose NGAP endpoints more broadly face elevated risk. The absence of any vendor response or patch is the most significant compounding factor: even operators with well-segmented networks have no remediation path at time of analysis beyond network-layer controls. The availability-only impact limits the worst-case outcome to service degradation rather than data breach, but disruption to an AMF in a live network can directly affect subscriber connectivity.

An attacker with access to the Magma AMF's N2 interface - whether through a compromised or spoofed gNB, or via an insufficiently segmented network - sends a crafted NGSetupRequest message containing an invalid NG-IoT-DefaultPagingDRX value that triggers the improper input validation flaw. The AMF's NGSetupRequest Handler processes the malformed parameter, causing process instability or a crash that degrades or interrupts connectivity for mobile subscribers served by that core instance. A public proof-of-concept is available via GitHub issue #16023, reducing the technical barrier for attempted exploitation.