CVE-2026-80851
Received Received - Intake

Race Condition in Linux Kernel GTP Module Leads to Use-After-Free

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: gtp: serialize PDP context updates PDP contexts can be deleted through GTP_CMD_DELPDP or while the GTP network device is being unregistered. The latter is serialized by RTNL, but the generic-netlink delete path only holds RCU. Running both paths concurrently can therefore make both paths delete the same PDP context. The issue was found through static analysis and reproduced on a KASAN-enabled kernel by a simple two-thread program racing GTP_CMD_DELPDP against RTM_DELLINK: Oops: general protection fault, probably for non-canonical address KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] RIP: gtp_genl_del_pdp+0x1c1/0x420 [gtp] RBP: dead000000000122 The second deletion dereferenced the poisoned hlist pprev pointer. Serialize gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink() with a shared mutex. Keep the mutex held until the final use of a PDP context in the NEWPDP path, and keep the RCU read-side section around the complete PDP context use in the DELPDP path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80851
EUVD
EUVD-2026-71301

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the GTP (GPRS Tunneling Protocol) module where PDP (Packet Data Protocol) contexts can be deleted concurrently through different paths. One path is serialized by RTNL, but the other path using generic-netlink only holds RCU, leading to potential double deletion of the same PDP context. This can cause memory corruption and kernel crashes.

Detection Guidance

This vulnerability may cause kernel crashes or memory corruption when PDP contexts are deleted concurrently. Monitor kernel logs for general protection faults or KASAN warnings related to GTP. Check for crashes during GTP_CMD_DELPDP or RTM_DELLINK operations.

Impact Analysis

This vulnerability can cause system instability, including kernel crashes or general protection faults, due to memory corruption. If exploited, it may lead to denial-of-service conditions or potential privilege escalation in systems running vulnerable Linux kernel versions with GTP support enabled.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel memory safety issue related to PDP context handling in GTP networking. Compliance impacts would depend on system configuration and data exposure, not the vulnerability itself.

Mitigation Strategies

Apply the Linux kernel patch that serializes PDP context updates with a shared mutex. Update to a kernel version containing the fix. If immediate patching is not possible, restrict access to GTP operations or disable the GTP module until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80851. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart