Executive brief
The Linux kernel's GTP (GPRS Tunneling Protocol) driver can free memory without properly waiting for all concurrent network processing to complete, allowing a race condition where incoming packets may access already-freed data structures. This can cause the system to crash or become unstable when a GTP tunnel creation fails.
Technical details
The vulnerability is a use-after-free race condition in the gtp_newlink() function within drivers/net/gtp.c. When tunnel creation fails, the error path frees tid_hash and addr_hash without calling synchronize_net() to wait for an RCU grace period after clearing sk_user_data. Concurrently, the gtp_encap_recv() softirq handler may still hold a reference to the gtp_dev structure obtained via rcu_dereference_sk_user_data() and attempt to access the freed memory, triggering a slab-use-after-free condition. The fix adds synchronize_net() in the out_hashtable error path to ensure all RCU readers complete before freeing the hash tables. No authentication or special privileges are required; the vulnerability is triggered during normal tunnel creation/teardown on systems running affected kernel versions.
Affected products
- Linux Linux kernel multiple versions prior to the patch (commit d989e22ae9802c52c56ad4284d0caf26696cf6ae)
Timeline
- 2026-09-16: disclosed: Advisory published on NVD
- 2026-08-19: patched: Patch submitted by Cen Zhang; integrated into stable kernel trees