Executive brief
Free5GC is an open-source 5G network core implementation used to build mobile network infrastructure. The UPF (User Plane Function) component crashes when it receives a delayed session report for an already-deleted session, causing the entire user plane to become unavailable and interrupting mobile data service for all connected devices.
Technical details
The vulnerability is a nil pointer dereference in the UPF component's PFCP (Packet Forwarding Control Protocol) session handling. When a PFCP Session Report Response arrives for a session that has already been deleted locally, the code performs a session lookup that returns nil but fails to check for this condition before dereferencing the pointer, causing a panic. The attack is remotely triggered by sending a delayed or out-of-order PFCP Session Report Response message to the UPF network interface (typically reachable from other 5G core components). No authentication is required. Successful exploitation results in immediate denial of service as the UPF process crashes and stops processing user data traffic.
Affected products
- Free5GC Free5GC v4.2.2
Timeline
- 2026-06-04: disclosed: Bug reported on GitHub issue #1059
- 2026-09-04: other: CVE-2026-75439 published