HIGH Introduced in 4.7
gtp NewLink UAF
CVE-2026-89789
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free gtp_newlink()'s error path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing sk_user_data. A concurrent gtp_encap_recv() in softirq may still hold the gtp_dev pointer obtained via rcu_dereference_sk_user_data() and access the freed memory. BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152) Call Trace: <IRQ> gtp0_pdp_find+0x1f6/0x200 gtp_encap_recv+0x527/0x24b0 udp_queue_rcv_one_skb+0x75f/0xc10 Add synchronize_net() before the kfree calls in out_hashtable, which covers all error paths from both gtp_encap_enable() and gtp_create_sockets().
02KernelScan AI Analysis
Risk summary
A local attacker who can create GTP tunnel devices (CAP_NET_ADMIN, obtainable via user namespaces) can race the device-creation error path against incoming UDP packets to trigger a use-after-free in kernel heap memory. This can lead to kernel crashes or potentially arbitrary code execution. Systems that block unprivileged namespace creation or do not use GTP tunneling are not affected.
Vulnerability analysis
When creating a GTP tunnel device fails after encapsulation sockets have been set up, the error cleanup path frees the device's internal hash tables without waiting for in-flight packet processing to finish. A concurrently running receive handler in softirq context may still be referencing the device's data through an RCU-protected pointer, leading to a use-after-free on kernel heap memory. The fix inserts a network-wide RCU synchronization barrier before the hash tables are freed, ensuring all concurrent readers have completed before the memory is released. This issue is reachable locally by any user who can create GTP tunnel devices via netlink, which requires CAP_NET_ADMIN—obtainable inside a user namespace on most default configurations—and the use-after-free is triggered by the race between the error cleanup and an incoming UDP packet on the tunnel's encapsulation socket.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.7 | 5.10.270 | fcafb2b14308 |
| 6.1 | 4.7 | 6.1.188 | 6f815c2fb6ab |
| 6.18 | 4.7 | 6.18.52 | 7677eb2cbf2c |
| 7.2 | 4.7 | 7.2.6 | 8d85498016a5 |
| mainline | 4.7 | 7.3-rc1 | d989e22ae980 |
| 6.6 | 4.7 | 6.6.157 | e3b9aa0773ab |
| 6.12 | 4.7 | 6.12.110 | fd8396cfecbd |
| 5.15 | 4.7 | 5.15.221 | 3ca3da5c305c |
| cip/6.12 | 4.7 | 6.12.111-cip32 | fd8396cfecbd |