CVE-2026-94043
Received Received - Intake

Race Condition in Free5GC

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulDB

Description
A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go of the component Gmm Handler. This manipulation causes race condition. The attack can be initiated remotely. Patch name: e323b01464355781b8b8d5dd695e05cbc00a62f2. To fix this issue, it is recommended to deploy a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-21
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-94043
EUVD
EUVD-2026-83769

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
free5gc free5gc to 4.2.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in Free5GC up to version 4.2.3 affecting the Gmm Handler component. It occurs when multiple threads access or modify shared data simultaneously without proper synchronization, leading to crashes or undefined behavior. The issue specifically involves unsafe concurrent access to the RanUe context map in the AMF (Access and Mobility Management Function).

Detection Guidance

Detecting this race condition requires monitoring for crashes in the free5GC AMF component, particularly during SCTP connection shutdowns while processing RegistrationRequest messages. Check AMF logs for fatal errors related to concurrent map access or goroutine crashes. Use tools like 'journalctl -u free5gc-amf' to review system logs for AMF crashes or segmentation faults.

Impact Analysis

This vulnerability can cause the AMF component of Free5GC to crash due to a denial-of-service (DoS) condition. When multiple registration requests are processed over the same connection and the connection is abruptly closed, the system may fail to handle the context safely, resulting in crashes. This disrupts 5G network operations and services.

Compliance Impact

This vulnerability, a race condition in free5GC's AMF component, could lead to denial-of-service conditions by crashing the system during concurrent access to UE/RAN context maps. Such instability may disrupt critical telecommunication services, potentially causing unauthorized data exposure or service interruptions that could violate compliance requirements for availability and security in standards like GDPR and HIPAA.

Mitigation Strategies

Apply the provided patch (commit e323b01464355781b8b8d5dd695e05cbc00a62f2) to synchronize access to the RanUe context using a mutex. Update to free5GC version 4.2.4 or later. Monitor AMF logs for crashes and ensure proper handling of SCTP connection closures during registration procedures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94043. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart