Executive brief
The Linux kernel's GTP (GPRS Tunneling Protocol) module contains a race condition that allows concurrent deletion of the same PDP context through two different code paths, causing a crash. This affects systems using GTP tunneling for mobile network functions and can result in denial of service.
Technical details
The vulnerability is a use-after-free race condition in the GTP module's PDP context deletion logic. The gtp_genl_del_pdp() function (invoked via GTP_CMD_DELPDP netlink command) only holds RCU read-side protection, while gtp_dellink() (device unregistration) is protected by RTNL. When both code paths execute concurrently, both can delete the same PDP context, causing the second deletion to dereference a poisoned hlist pprev pointer, resulting in a general protection fault (KASAN detected wild-memory-access). The fix serializes gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink() using a shared mutex (gtp_pdp_lock) to prevent concurrent access. A local attacker can trigger this by racing GTP_CMD_DELPDP netlink commands against device unregistration.
Affected products
- Linux Linux kernel multiple versions (GTP module)
Timeline
- 2026-09-04: disclosed
- 2026-09-02: patched