CVE-2026-80851: gtp: serialize PDP context updates

CVE-2026-80851: gtp: serialize PDP context updates

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

gtp: serialize PDP context updates

PDP contexts can be deleted through GTP_CMD_DELPDP or while the GTP
network device is being unregistered. The latter is serialized by RTNL,
but the generic-netlink delete path only holds RCU.

Running both paths concurrently can therefore make both paths delete the
same PDP context. The issue was found through static analysis and
reproduced on a KASAN-enabled kernel by a simple two-thread program
racing GTP_CMD_DELPDP against RTM_DELLINK:

  Oops: general protection fault, probably for non-canonical address
  KASAN: maybe wild-memory-access in range
         [0xdead000000000120-0xdead000000000127]
  RIP: gtp_genl_del_pdp+0x1c1/0x420 [gtp]
  RBP: dead000000000122

The second deletion dereferenced the poisoned hlist pprev pointer.

Serialize gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink() with a
shared mutex. Keep the mutex held until the final use of a PDP context in
the NEWPDP path, and keep the RCU read-side section around the complete
PDP context use in the DELPDP path.

The Linux kernel CVE team has assigned CVE-2026-80851 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 6.12.108 with commit 5f77ddb2756340c1b05381674ca025d52998005e
	Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 6.18.49 with commit 3d950e98f74af9611925a5226edced02155f6ed1
	Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 7.1.13 with commit 6df4f05bc2991467939d7d80b6f7e121559cc3df
	Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 7.2.3 with commit 1e995498d29784a06a2b2899370a1926cfc8410d
	Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 7.3-rc1 with commit 498386b6d402737db1e2eeed4c385acbf0ef9e34

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-80851
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/gtp.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5f77ddb2756340c1b05381674ca025d52998005e
	https://git.kernel.org/stable/c/3d950e98f74af9611925a5226edced02155f6ed1
	https://git.kernel.org/stable/c/6df4f05bc2991467939d7d80b6f7e121559cc3df
	https://git.kernel.org/stable/c/1e995498d29784a06a2b2899370a1926cfc8410d
	https://git.kernel.org/stable/c/498386b6d402737db1e2eeed4c385acbf0ef9e34