CVE-2026-64577
Received Received - Intake

Buffer Over-read in Linux Kernel GTP Module

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() gtp1u_send_echo_resp() ignores skb_pull_data()'s return value. Its caller gtp1u_udp_encap_recv() only guarantees 16 bytes (udphdr + gtp1_header), but the pull requests 20 (gtp1_header_long + udphdr). For a 16-19 byte echo request the pull fails and returns NULL without advancing skb->data; execution continues, and the following skb_push() plus the IP header pushed by iptunnel_xmit() move skb->data below skb->head, tripping skb_under_panic(). Fix it by dropping the packet when skb_pull_data() fails. skbuff: skb_under_panic: ... kernel BUG at net/core/skbuff.c:214! Call Trace: skb_push (net/core/skbuff.c:2648) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:82) gtp_encap_recv (drivers/net/gtp.c:701 drivers/net/gtp.c:808 drivers/net/gtp.c:920) udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) ... Kernel panic - not syncing: Fatal exception in interrupt

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-64577
EUVD
EUVD-2026-53271

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the GTP (GPRS Tunneling Protocol) module. The function gtp1u_send_echo_resp() fails to check the return value of skb_pull_data(), which can lead to a kernel panic. When processing malformed echo requests with insufficient data, the function attempts to push data beyond the skb buffer's head, causing a crash.

Detection Guidance

This vulnerability may cause kernel panics due to skb_under_panic. Monitor system logs for kernel panic messages or skb_under_panic errors. Check for crashes in GTP-related network functions. No specific detection commands are provided in the context.

Impact Analysis

This vulnerability can cause a system crash (kernel panic) when processing specific network packets. This leads to denial of service, requiring a system reboot to restore functionality. It affects systems using GTP tunneling, typically in mobile network environments or VPN setups.

Compliance Impact

This vulnerability causes kernel panics due to memory corruption, leading to system crashes. Such instability may disrupt data processing and availability, potentially violating availability requirements in GDPR and HIPAA. However, no direct impact on data confidentiality or integrity is described.

Mitigation Strategies

Apply the Linux kernel patch that fixes the issue by dropping packets when skb_pull_data() fails. Update to a patched kernel version. If immediate patching is not possible, consider disabling GTP-related modules or network functions until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64577. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart