CVE-2026-89789 - Vulnerability Details

- gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free

Description

In the Linux kernel, the following vulnerability has been resolved:

gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free

gtp_newlink()'s error path frees tid_hash and addr_hash without
waiting for an RCU grace period after clearing sk_user_data. A
concurrent gtp_encap_recv() in softirq may still hold the gtp_dev
pointer obtained via rcu_dereference_sk_user_data() and access the
freed memory.

BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152)
Call Trace:
<IRQ>
gtp0_pdp_find+0x1f6/0x200
gtp_encap_recv+0x527/0x24b0
udp_queue_rcv_one_skb+0x75f/0xc10

Add synchronize_net() before the kfree calls in out_hashtable, which
covers all error paths from both gtp_encap_enable() and
gtp_create_sockets().

Published: 2026-09-16

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A bug in the Linux kernel’s GTP driver means that the error path of gtp_newlink() frees hash tables before an RCU grace period has elapsed. During this brief window a concurrent gtp_encap_recv() from a softirq can still dereference the freed gtp_dev pointer, leading to a use‑after‑free. This memory corruption can cause a kernel panic or, if exploited carefully, could enable code execution with kernel privileges.

Affected Systems

The flaw resides in the Linux kernel, affecting any release that includes the vulnerable GTP driver code and has not yet been updated to the commit that introduces synchronize_net() in the error path. All kernel packages managed by the Linux:Linux CNA are potentially impacted, as indicated by the generic Linux kernel cpe in the advisory.

Risk and Exploitability

No CVSS or EPSS score is currently published, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because the bug introduces a classic use‑after‑free in kernel space, the theoretical impact is high: a successful exploit could lead to denial of service or privilege escalation. Inferred from the description, the likely attack vector would involve sending specially crafted GTP traffic that triggers the vulnerable path, but details remain unspecified, so the exact exploitation complexity is uncertain.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< fcafb2b1430824bae4258c01a439ec97ca0c6973
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< 3ca3da5c305caa873ddb81e8c6b118143f6dd3d1
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< 6f815c2fb6ab20385f81c353cdad0ea3b88132af
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< e3b9aa0773abd5d4ed90be41ce5306c146d5b09e
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< fd8396cfecbd904468c71362f08aaa25f96d5337
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< 7677eb2cbf2cc7446de474c01a6b06277c0051e5
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< 8d85498016a5bb56339734a14c276209fa65bafc
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< d989e22ae9802c52c56ad4284d0caf26696cf6ae

Linux

affected

Version	Status	Constraints
`4.7`	affected	—
`0`	unaffected	< 4.7
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[459aa660eb1d8ce67080da1983bb81d716aa5a69,fcafb2b1430824bae4258c01a439ec97ca0c6973)`	affected	code_commit	—
`[459aa660eb1d8ce67080da1983bb81d716aa5a69,3ca3da5c305caa873ddb81e8c6b118143f6dd3d1)`	affected	code_commit	—
`[459aa660eb1d8ce67080da1983bb81d716aa5a69,6f815c2fb6ab20385f81c353cdad0ea3b88132af)`	affected	code_commit	—
`[459aa660eb1d8ce67080da1983bb81d716aa5a69,e3b9aa0773abd5d4ed90be41ce5306c146d5b09e)`	affected	code_commit	—
`[459aa660eb1d8ce67080da1983bb81d716aa5a69,fd8396cfecbd904468c71362f08aaa25f96d5337)`	affected	code_commit	—
`[459aa660eb1d8ce67080da1983bb81d716aa5a69,7677eb2cbf2cc7446de474c01a6b06277c0051e5)`	affected	code_commit	—
`[459aa660eb1d8ce67080da1983bb81d716aa5a69,8d85498016a5bb56339734a14c276209fa65bafc)`	affected	code_commit	—
`[459aa660eb1d8ce67080da1983bb81d716aa5a69,d989e22ae9802c52c56ad4284d0caf26696cf6ae)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.7`	affected	generic	—
`[0,4.7)`	unaffected	generic	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the synchronize_net() patch in gtp_newlink().
Reboot the affected systems after applying the kernel patch to ensure all hot‑patches are fully applied.
If the GTP driver is not required for your environment, consider disabling or removing the module to eliminate the attack surface.
Monitor kernel logs (e.g., dmesg) for KASAN or Oops messages that might indicate an attempted exploitation.

Generated by OpenCVE AI on September 16, 2026 at 14:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0021.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3ca3da5c305caa873ddb81e8c6b118143f6dd3d1
https://git.kernel.org/stable/c/6f815c2fb6ab20385f81c353cdad0ea3b88132af
https://git.kernel.org/stable/c/7677eb2cbf2cc7446de474c01a6b06277c0051e5
https://git.kernel.org/stable/c/8d85498016a5bb56339734a14c276209fa65bafc
https://git.kernel.org/stable/c/d989e22ae9802c52c56ad4284d0caf26696cf6ae
https://git.kernel.org/stable/c/e3b9aa0773abd5d4ed90be41ce5306c146d5b09e
https://git.kernel.org/stable/c/fcafb2b1430824bae4258c01a439ec97ca0c6973
https://git.kernel.org/stable/c/fd8396cfecbd904468c71362f08aaa25f96d5337

History

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 16 Sep 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free gtp_newlink()'s error path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing sk_user_data. A concurrent gtp_encap_recv() in softirq may still hold the gtp_dev pointer obtained via rcu_dereference_sk_user_data() and access the freed memory. BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152) Call Trace: <IRQ> gtp0_pdp_find+0x1f6/0x200 gtp_encap_recv+0x527/0x24b0 udp_queue_rcv_one_skb+0x75f/0xc10 Add synchronize_net() before the kfree calls in out_hashtable, which covers all error paths from both gtp_encap_enable() and gtp_create_sockets().
Title		gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3ca3da5c305caa873ddb81e8c6b118143f6dd3d1 https://git.kernel.org/stable/c/6f815c2fb6ab20385f81c353cdad0ea3b88132af https://git.kernel.org/stable/c/7677eb2cbf2cc7446de474c01a6b06277c0051e5 https://git.kernel.org/stable/c/8d85498016a5bb56339734a14c276209fa65bafc https://git.kernel.org/stable/c/d989e22ae9802c52c56ad4284d0caf26696cf6ae https://git.kernel.org/stable/c/e3b9aa0773abd5d4ed90be41ce5306c146d5b09e https://git.kernel.org/stable/c/fcafb2b1430824bae4258c01a439ec97ca0c6973 https://git.kernel.org/stable/c/fd8396cfecbd904468c71362f08aaa25f96d5337

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T08:48:25.689Z

Updated: 2026-09-16T14:38:38.871Z

Reserved: 2026-09-11T19:38:34.766Z

Link: CVE-2026-89789

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T09:17:09.697

Modified: 2026-09-16T15:18:09.107

Link: CVE-2026-89789

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-16T14:30:10Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object