CVE-2026-74286

Received Received - Intake

Null Pointer Dereference in Linux Kernel PFCP

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses dev_get_tstats64() as its ndo_get_stats64 callback, but pfcp_link_setup() does not request NETDEV_PCPU_STAT_TSTATS. The net core therefore leaves dev->tstats NULL for PFCP devices. Creating a PFCP rtnetlink device can immediately ask the new netdev for stats while building the RTM_NEWLINK notification. That reaches dev_get_tstats64() and dereferences the NULL dev->tstats pointer. Set pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS during PFCP link setup so the net core allocates the storage expected by dev_get_tstats64().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74286

EUVD

EUVD-2026-59433

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a missing allocation of per-CPU statistics for PFCP (Packet Forwarding Control Protocol) network devices. When a PFCP device is created, the system attempts to retrieve statistics but fails because the required memory was not allocated, leading to a NULL pointer dereference and potential system crash.

Detection Guidance

This vulnerability may be detected by checking for PFCP netdev devices with missing tstats allocation. Look for kernel logs or errors related to NULL pointer dereference in dev_get_tstats64() during rtnetlink device creation. Use commands like dmesg | grep -i pfcp or ip link show to inspect network devices.

Impact Analysis

This vulnerability could cause a kernel panic or system crash when a PFCP network device is created or accessed, potentially leading to denial of service. Systems relying on PFCP for network functions may become unstable or unresponsive.

Compliance Impact

This vulnerability is specific to the Linux kernel's PFCP (Packet Forwarding Control Protocol) implementation and involves a NULL pointer dereference in network device statistics handling. It does not directly relate to data privacy, security controls, or compliance requirements under standards like GDPR or HIPAA.

Mitigation Strategies

Apply the kernel patch that sets pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS during PFCP link setup. Update to a fixed Linux kernel version where this issue is resolved. Monitor for crashes or errors in PFCP device operations until patched.

Hi! I’m here to help you understand CVE-2026-74286. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70