From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-80851: gtp: serialize PDP context updates
Date: Fri, 4 Sep 2026 17:53:18 +0200 [thread overview]
Message-ID: <2026090400-CVE-2026-80851-cf49@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
gtp: serialize PDP context updates
PDP contexts can be deleted through GTP_CMD_DELPDP or while the GTP
network device is being unregistered. The latter is serialized by RTNL,
but the generic-netlink delete path only holds RCU.
Running both paths concurrently can therefore make both paths delete the
same PDP context. The issue was found through static analysis and
reproduced on a KASAN-enabled kernel by a simple two-thread program
racing GTP_CMD_DELPDP against RTM_DELLINK:
Oops: general protection fault, probably for non-canonical address
KASAN: maybe wild-memory-access in range
[0xdead000000000120-0xdead000000000127]
RIP: gtp_genl_del_pdp+0x1c1/0x420 [gtp]
RBP: dead000000000122
The second deletion dereferenced the poisoned hlist pprev pointer.
Serialize gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink() with a
shared mutex. Keep the mutex held until the final use of a PDP context in
the NEWPDP path, and keep the RCU read-side section around the complete
PDP context use in the DELPDP path.
The Linux kernel CVE team has assigned CVE-2026-80851 to this issue.
Affected and fixed versions
===========================
Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 6.12.108 with commit 5f77ddb2756340c1b05381674ca025d52998005e
Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 6.18.49 with commit 3d950e98f74af9611925a5226edced02155f6ed1
Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 7.1.13 with commit 6df4f05bc2991467939d7d80b6f7e121559cc3df
Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 7.2.3 with commit 1e995498d29784a06a2b2899370a1926cfc8410d
Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 7.3-rc1 with commit 498386b6d402737db1e2eeed4c385acbf0ef9e34
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-80851
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/net/gtp.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/5f77ddb2756340c1b05381674ca025d52998005e
https://git.kernel.org/stable/c/3d950e98f74af9611925a5226edced02155f6ed1
https://git.kernel.org/stable/c/6df4f05bc2991467939d7d80b6f7e121559cc3df
https://git.kernel.org/stable/c/1e995498d29784a06a2b2899370a1926cfc8410d
https://git.kernel.org/stable/c/498386b6d402737db1e2eeed4c385acbf0ef9e34
reply other threads:[~2026-09-04 15:57 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026090400-CVE-2026-80851-cf49@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.