gtp NewLink UAF

Vulnerability analysis

When creating a GTP tunnel device fails after encapsulation sockets have been set up, the error cleanup path frees the device's internal hash tables without waiting for in-flight packet processing to finish. A concurrently running receive handler in softirq context may still be referencing the device's data through an RCU-protected pointer, leading to a use-after-free on kernel heap memory. The fix inserts a network-wide RCU synchronization barrier before the hash tables are freed, ensuring all concurrent readers have completed before the memory is released. This issue is reachable locally by any user who can create GTP tunnel devices via netlink, which requires CAP_NET_ADMIN—obtainable inside a user namespace on most default configurations—and the use-after-free is triggered by the race between the error cleanup and an incoming UDP packet on the tunnel's encapsulation socket.