CVE-2026-89789gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free gtp_newlink()'s error path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing sk_user_data. A concurrent gtp_encap_recv() in softirq may still hold the gtp_dev pointer obtained via rcu_dereference_sk_user_data() and access the freed memory. BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152) Call Trace: <IRQ> gtp0_pdp_find+0x1f6/0x200 gtp_encap_recv+0x527/0x24b0 udp_queue_rcv_one_skb+0x75f/0xc10 Add synchronize_net() before the kfree calls in out_hashtable, which covers all error paths from both gtp_encap_enable() and gtp_create_sockets().
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 459aa660eb1d8ce67080da1983bb81d716aa5a69 before fcafb2b1430824bae4258c01a439ec97ca0c6973; 459aa660eb1d8ce67080da1983bb81d716aa5a69 builds before 3ca3da5c305caa873ddb81e8c6b118143f6dd3d1; 459aa660eb1d8ce67080da1983bb81d716aa5a69 builds before 6f815c2fb6ab20385f81c353cdad0ea3b88132af; from 459aa660eb1d8ce67080da1983bb81d716aa5a69 before e3b9aa0773abd5d4ed90be41ce5306c146d5b09e; from 459aa660eb1d8ce67080da1983bb81d716aa5a69 before fd8396cfecbd904468c71362f08aaa25f96d5337; from 459aa660eb1d8ce67080da1983bb81d716aa5a69 before 7677eb2cbf2cc7446de474c01a6b06277c0051e5; 459aa660eb1d8ce67080da1983bb81d716aa5a69 builds before 8d85498016a5bb56339734a14c276209fa65bafc; from 459aa660eb1d8ce67080da1983bb81d716aa5a69 before d989e22ae9802c52c56ad4284d0caf26696cf6ae | CNA record |
References
- https://git.kernel.org/stable/c/fcafb2b1430824bae4258c01a439ec97ca0c6973
- https://git.kernel.org/stable/c/3ca3da5c305caa873ddb81e8c6b118143f6dd3d1
- https://git.kernel.org/stable/c/6f815c2fb6ab20385f81c353cdad0ea3b88132af
- https://git.kernel.org/stable/c/e3b9aa0773abd5d4ed90be41ce5306c146d5b09e
- https://git.kernel.org/stable/c/fd8396cfecbd904468c71362f08aaa25f96d5337
- https://git.kernel.org/stable/c/7677eb2cbf2cc7446de474c01a6b06277c0051e5
- https://git.kernel.org/stable/c/8d85498016a5bb56339734a14c276209fa65bafc
- https://git.kernel.org/stable/c/d989e22ae9802c52c56ad4284d0caf26696cf6ae
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.