Executive brief
A vulnerability in the Linux kernel's GPRS Tunneling Protocol (GTP) implementation could allow a local user to cause a system crash. The issue occurs during the cleanup of network namespaces, where certain internal data structures are processed incorrectly. This leads to a kernel panic, resulting in a denial-of-service condition that disrupts all operations on the affected system.
Technical details
A double-free or double-unlinking vulnerability exists in the GTP (GPRS Tunneling Protocol) driver within the Linux kernel. The root cause is in gtp_net_exit_batch_rtnl(), where a loop iterating over network devices could trigger the dellink() function twice for the same device if that device's UDP socket resides in a different namespace than the device itself. This results in a list_del() corruption splat and a kernel BUG at lib/list_debug.c:58 when CONFIG_DEBUG_LIST is enabled, or potential memory corruption otherwise. The fix removes the redundant for_each_netdev() loop and delegates device destruction to the default batch exit handler.
Affected products
- Linux Linux kernel 6.12.13 and earlier
Timeline
- 2025-02-17: patched: Initial patch submitted to kernel.org
- 2025-03-12: disclosed: CVE published
References
- https://git.kernel.org/stable/c/33eb925c0c26e86ca540a08254806512bf911f22
- https://git.kernel.org/stable/c/37e7644b961600ef0beb01d3970c3034a62913af
- https://git.kernel.org/stable/c/4ccacf86491d33d2486b62d4d44864d7101b299d
- https://git.kernel.org/stable/c/7f86fb07db65a470d0c11f79da551bd9466357dc
- https://git.kernel.org/stable/c/9d03e7e37187ae140e716377599493987fb20c5b
- https://git.kernel.org/stable/c/b70fa591b066d52b141fc430ffdee35b6cc87a66
- https://git.kernel.org/stable/c/cb15bb1bde0ba97cbbed9508e45210dcafec3657