Executive brief
The Linux kernel's PFCP (Packet Forwarding Control Protocol) networking module had a defect in device initialization that could cause a system crash when querying network statistics. When a PFCP network device was created, the kernel would attempt to access uninitialized memory while building status notifications, resulting in a null pointer dereference that crashes or destabilizes the kernel.
Technical details
The vulnerability is a null pointer dereference in the Linux kernel's PFCP module. The root cause is that pfcp_link_setup() does not request NETDEV_PCPU_STAT_TSTATS when initializing a PFCP network device, leaving dev->tstats as NULL. When a PFCP device is created via rtnetlink, the kernel immediately queries device statistics while building the RTM_NEWLINK notification message. This causes dev_get_tstats64() (the ndo_get_stats64 callback) to dereference the uninitialized NULL pointer. An unprivileged local user or remote attacker with capability to create PFCP devices can trigger the crash. The fix is a one-line patch: setting dev->pcpu_stat_type = NETDEV_PCPU_STAT_TSTATS during PFCP link setup to ensure proper memory allocation before statistics queries.
Affected products
- Linux Linux kernel versions with PFCP module (linux-5.9 and later)
Timeline
- 2026-06-11: patched: Fix committed to mainline kernel