CVE-2026-89789

UNKNOWN 0.0

gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free gtp_newlink()'s error path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing sk_user_data. A concurrent gtp_encap_recv() in softirq may still hold the gtp_dev pointer obtained via rcu_dereference_sk_user_data() and access the freed memory. BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152) Call Trace: <IRQ> gtp0_pdp_find+0x1f6/0x200 gtp_encap_recv+0x527/0x24b0 udp_queue_rcv_one_skb+0x75f/0xc10 Add synchronize_net() before the kfree calls in out_hashtable, which covers all error paths from both gtp_encap_enable() and gtp_create_sockets().

Vendor	linux
Product	linux
Ecosystems	Linux Kernel
Industries	Technology
Published	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for linux linux

Be the first to know when new unknown vulnerabilities affecting linux linux are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Linux / Linux

459aa660eb1d8ce67080da1983bb81d716aa5a69 < fcafb2b1430824bae4258c01a439ec97ca0c6973 459aa660eb1d8ce67080da1983bb81d716aa5a69 < 3ca3da5c305caa873ddb81e8c6b118143f6dd3d1 459aa660eb1d8ce67080da1983bb81d716aa5a69 < 6f815c2fb6ab20385f81c353cdad0ea3b88132af 459aa660eb1d8ce67080da1983bb81d716aa5a69 < e3b9aa0773abd5d4ed90be41ce5306c146d5b09e 459aa660eb1d8ce67080da1983bb81d716aa5a69 < fd8396cfecbd904468c71362f08aaa25f96d5337 459aa660eb1d8ce67080da1983bb81d716aa5a69 < 7677eb2cbf2cc7446de474c01a6b06277c0051e5 459aa660eb1d8ce67080da1983bb81d716aa5a69 < 8d85498016a5bb56339734a14c276209fa65bafc 459aa660eb1d8ce67080da1983bb81d716aa5a69 < d989e22ae9802c52c56ad4284d0caf26696cf6ae

Linux / Linux

4.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗