From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0C22D4E8E0D for ; Fri, 4 Sep 2026 15:57:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788537449; cv=none; b=EjoA9SVamdpzfN9A/jvCv7RIdHqn/uQ5bY2x1HF/NexdDtzo5Nl7rBEE4ZzAVqp92XKIPf8bC6AQhgn28Om+c0d5mEfp/dwhOvvsW3qTtPOMSNaYf3gmMOVYHphHGILshVu2uNonG+qBRGdJdur1r9moiy/EZt3Rotf4UpyThcA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788537449; c=relaxed/simple; bh=LwWzff36uFwcktuq9PX93Fr+is12PBDUpTZqur8PSV4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=EV6AABps69rdcvmH8da0o3JLrqhesSjzr2EnmsFWtD7lQvHCKrjUKd/qTcf2EhrhHnzTdqZUQdF+ecbnb69iSu488r3SpcW+PLiQCt89QL4fLNLw3cTPZNzxM5uabKThb25Cd+/+Qhveu9NHT64AGJ1dJLfECT08FNevnMU9S/Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=edwxQcQH; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="edwxQcQH" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CAD6E1F00A3D; Fri, 4 Sep 2026 15:57:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788537447; bh=E9rw7qtahugpWv1fKXmRq6+np2JlGabMJZrEhy+J0rY=; h=From:To:Cc:Subject:Date:Reply-To; b=edwxQcQHjtV1Y+LPNBtmD3dX6EGAvNNQrgjA4kSR9bqRexNiVRLECppIs6wOScgd5 G4pcB3jyRIoss38b9QyXSCE/xI7VEsM6uozPYgns6KpzHfvBXScHVXOH1MRsLgNnme 67pETgIBEbzsIkGPqzgcwj1iSU5fB5EFmBfwUMlI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80851: gtp: serialize PDP context updates Date: Fri, 4 Sep 2026 17:53:18 +0200 Message-ID: <2026090400-CVE-2026-80851-cf49@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3430; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=nlRUySl0JUosmKPA+EXKid6ph7TEtnUlXtKoxB7fb+4=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmzXsb8Tvx0evLllssB90xcHux/K6QVw/Bzq7rxfwn9r bEmojLbOmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAiCZsY5kr5HbhxRytR8JGY QpNVYmIDq8d8A4Z52ip6akcfv4qUOH29NN+ye97ini9/AA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: gtp: serialize PDP context updates PDP contexts can be deleted through GTP_CMD_DELPDP or while the GTP network device is being unregistered. The latter is serialized by RTNL, but the generic-netlink delete path only holds RCU. Running both paths concurrently can therefore make both paths delete the same PDP context. The issue was found through static analysis and reproduced on a KASAN-enabled kernel by a simple two-thread program racing GTP_CMD_DELPDP against RTM_DELLINK: Oops: general protection fault, probably for non-canonical address KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] RIP: gtp_genl_del_pdp+0x1c1/0x420 [gtp] RBP: dead000000000122 The second deletion dereferenced the poisoned hlist pprev pointer. Serialize gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink() with a shared mutex. Keep the mutex held until the final use of a PDP context in the NEWPDP path, and keep the RCU read-side section around the complete PDP context use in the DELPDP path. The Linux kernel CVE team has assigned CVE-2026-80851 to this issue. Affected and fixed versions =========================== Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 6.12.108 with commit 5f77ddb2756340c1b05381674ca025d52998005e Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 6.18.49 with commit 3d950e98f74af9611925a5226edced02155f6ed1 Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 7.1.13 with commit 6df4f05bc2991467939d7d80b6f7e121559cc3df Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 7.2.3 with commit 1e995498d29784a06a2b2899370a1926cfc8410d Issue introduced in 4.7 with commit 459aa660eb1d8ce67080da1983bb81d716aa5a69 and fixed in 7.3-rc1 with commit 498386b6d402737db1e2eeed4c385acbf0ef9e34 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80851 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/gtp.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/5f77ddb2756340c1b05381674ca025d52998005e https://git.kernel.org/stable/c/3d950e98f74af9611925a5226edced02155f6ed1 https://git.kernel.org/stable/c/6df4f05bc2991467939d7d80b6f7e121559cc3df https://git.kernel.org/stable/c/1e995498d29784a06a2b2899370a1926cfc8410d https://git.kernel.org/stable/c/498386b6d402737db1e2eeed4c385acbf0ef9e34