CVE-2026-98849
Received Received - Intake

Double Free in Linux Kernel PFCP Socket Handling

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcp_newlink() creates the UDP socket before register_netdevice(). If registration fails after pfcp_dev_init() succeeds, the core calls pfcp_dev_uninit(), which releases the socket and clears pfcp->sk. The newlink error path then releases it again, causing a NULL pointer dereference. This was observed with failslab fault injection: FAULT_INJECTION: forcing a failure. kobject: kobject_add_internal failed for pfcp0 (error: -12 parent: net) BUG: KASAN: null-ptr-deref in udp_tunnel_sock_release+0x1c/0x50 Read of size 8 at addr 0000000000000120 by task ip/1037 Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0x78/0x90 print_report+0x468/0x5cc kasan_report+0xa4/0xf0 __asan_load8+0x7c/0xd0 udp_tunnel_sock_release+0x1c/0x50 pfcp_newlink+0x128/0x184 rtnl_newlink+0x848/0xe44 rtnetlink_rcv_msg+0x468/0x514 netlink_rcv_skb+0xc0/0x1f0 rtnetlink_rcv+0x18/0x24 netlink_unicast+0x4b8/0x558 netlink_sendmsg+0x2b8/0x584 ... Return from pfcp_del_sock() if pfcp->sk is NULL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98849
EUVD
EUVD-2026-103789

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 76c8764ef36a5d37ea2e551bda28ac7f028383ba
Linux Linux 76c8764ef36a5d37ea2e551bda28ac7f028383ba
Linux Linux 76c8764ef36a5d37ea2e551bda28ac7f028383ba
Linux Linux 76c8764ef36a5d37ea2e551bda28ac7f028383ba
Linux Linux 6.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a NULL pointer dereference in the PFCP (Packet Forwarding Control Protocol) module. It occurs when a UDP socket is created before a network device registration. If registration fails, the cleanup process attempts to release the socket twice, leading to a crash due to accessing a NULL pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's PFCP (Packet Forwarding Control Protocol) implementation and may not have direct detection commands. Monitor kernel logs for NULL pointer dereference errors in udp_tunnel_sock_release or pfcp_newlink functions. Check for crashes in network-related processes or kernel panics.

Impact Analysis

This vulnerability can cause system crashes or instability in systems running affected Linux kernel versions. It may lead to denial-of-service conditions if exploited, potentially disrupting network services relying on PFCP functionality.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If using a vulnerable kernel version, avoid triggering PFCP netdevice registration failures. Monitor kernel logs for related errors and update network drivers if necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98849. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart