Linux Foundation Magma EUVD-2026-68272

Exploitation requires network reachability to the Magma AMF's NGAP interface, which operates over SCTP (typically port 38412). The CVSS 4.0 PR:L metric indicates the attacker must hold low-level recognized standing - most likely a registered or spoofed gNB identity rather than a fully anonymous connection. The vulnerability is triggered through the gNB Termination Handler logic in ngap_amf.c; no specific non-default configuration is described in the available data, suggesting any default Magma 1.9.0 deployment exposing NGAP may be susceptible. Exploitation is practically limited by the network segmentation of the NGAP transport plane: in well-architected 5G deployments this interface is confined to an internal radio transport network and is not directly internet-accessible. The impact is confined to availability (VA:L) with no confidentiality or integrity compromise confirmed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) reflects a remotely exploitable, low-complexity flaw requiring low privileges - a realistic profile for any operator running an exposed Magma AMF. The E:P modifier confirms a proof-of-concept is publicly available, compressing the time window before potential weaponization. However, the availability impact is rated Low (VA:L) on the vulnerable system only, with no scope change to subsequent systems, suggesting partial service degradation rather than full core network outage. The overall score of 5.3 (Medium) captures these balancing factors. This CVE is not listed in CISA KEV, meaning confirmed active exploitation is absent from available intelligence. No EPSS score was provided, preventing quantitative exploitation probability assessment. The PR:L requirement means unauthenticated exploitation is not indicated - an attacker needs some recognized standing on the NGAP plane, such as a registered or spoofed gNB identity. For operators without strict SCTP-layer access controls on the NGAP interface, the public PoC availability is the primary urgency driver despite the moderate score.

An attacker with low-level access to the Magma AMF's NGAP interface - such as a rogue or compromised gNB, or an operator with minimal credentials - sends crafted gNB termination messages designed to trigger the improper resource release in ngap_amf.c. Repeated delivery of such messages causes resource exhaustion or crashes the AMF process, disrupting core network services for all UEs served by that instance. The publicly available proof-of-concept on GitHub lowers the skill bar for exploitation.