Linux Foundation Magma EUVD-2026-68273

The AMF's NGAP N2 interface (SCTP port 38412) must be reachable from the attacker's network position - no authentication or prior session is required, consistent with PR:N/UI:N in the CVSS vector. The attacker must be able to send valid-looking but semantically malformed NGAP NGSetup Request PDUs; a public proof-of-concept exists. Exploitation is limited to environments running Linux Foundation Magma 1.9.0 (or potentially other versions given the wildcard CPE) with the AMF component deployed and the N2 interface exposed. Environments that firewall SCTP port 38412 to only known gNB IP addresses significantly limit the exploitable surface.

The CVSS 4.0 score of 6.9 reflects a network-reachable, zero-privilege, low-complexity attack path (AV:N/AC:L/AT:N/PR:N/UI:N), but the actual impact ceiling is low: only VI:L is asserted, with no confidentiality or availability consequence (VC:N/VA:N). The E:P modifier confirms a public proof-of-concept exists, elevating the practical exploitability beyond base scoring. No CISA KEV listing indicates no confirmed mass or targeted exploitation as of analysis. EPSS data was not provided; however, given the niche telecom-infrastructure deployment context and low impact, broad opportunistic exploitation is unlikely. The 'Information Disclosure' tag in the input data conflicts with the CWE-371 root cause and the CVSS impact showing zero confidentiality loss - this tag is likely mislabeled. Real-world priority is low-to-medium for operators running Magma-based 5G cores; general enterprise environments are unaffected.

An attacker operating a rogue software-defined radio stack or emulated gNB connects to the exposed NGAP/SCTP interface (port 38412) of a Magma AMF and transmits a crafted NGSetup Request message that triggers an unexpected state transition in ngap_amf_handlers.c. The public proof-of-concept on GitHub issue #16021 demonstrates this path. The resulting corrupted AMF state can affect the integrity of gNB registration tracking, potentially interfering with how the core network accounts for connected base stations.