CVE-2026-80851

gtp: serialize PDP context updates

Published Sep 4, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

gtp: serialize PDP context updates

PDP contexts can be deleted through GTP_CMD_DELPDP or while the GTP
network device is being unregistered. The latter is serialized by RTNL,
but the generic-netlink delete path only holds RCU.

Running both paths concurrently can therefore make both paths delete the
same PDP context. The issue was found through static analysis and
reproduced on a KASAN-enabled kernel by a simple two-thread program
racing GTP_CMD_DELPDP against RTM_DELLINK:

Oops: general protection fault, probably for non-canonical address
KASAN: maybe wild-memory-access in range
[0xdead000000000120-0xdead000000000127]
RIP: gtp_genl_del_pdp+0x1c1/0x420 [gtp]
RBP: dead000000000122

The second deletion dereferenced the poisoned hlist pprev pointer.

Serialize gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink() with a
shared mutex. Keep the mutex held until the final use of a PDP context in
the NEWPDP path, and keep the RCU read-side section around the complete
PDP context use in the DELPDP path.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< d8ebf8875fb97b3e39aa226af78f9c619e96ee31
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< 6e5472c1c1619793cbadb02bccf7d2d9f826052f
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< d9a83492ffc99f228d91873473e3820300525f00
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< b4ac2a5ce5a96ec21ed48f60d30b52b1fb22c62a
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< 5f77ddb2756340c1b05381674ca025d52998005e
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< 3d950e98f74af9611925a5226edced02155f6ed1
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< 6df4f05bc2991467939d7d80b6f7e121559cc3df
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< 1e995498d29784a06a2b2899370a1926cfc8410d
`459aa660eb1d8ce67080da1983bb81d716aa5a69`	affected	< 498386b6d402737db1e2eeed4c385acbf0ef9e34

Linux

affected

Version	Status	Constraints
`4.7`	affected	—
`0`	unaffected	< 4.7
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.108`	unaffected	≤ 6.12.*
`6.18.49`	unaffected	≤ 6.18.*
`7.1.13`	unaffected	≤ 7.1.*
`7.2.3`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[459aa660eb1d8ce67080da1983bb81d716aa5a69,5f77ddb2756340c1b05381674ca025d52998005e)`	affected	code_commit	—
`[459aa660eb1d8ce67080da1983bb81d716aa5a69,3d950e98f74af9611925a5226edced02155f6ed1)`	affected	code_commit	—
`[459aa660eb1d8ce67080da1983bb81d716aa5a69,6df4f05bc2991467939d7d80b6f7e121559cc3df)`	affected	code_commit	—
`[459aa660eb1d8ce67080da1983bb81d716aa5a69,1e995498d29784a06a2b2899370a1926cfc8410d)`	affected	code_commit	—
`[459aa660eb1d8ce67080da1983bb81d716aa5a69,498386b6d402737db1e2eeed4c385acbf0ef9e34)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.7`	affected	generic	—
`[0,4.7)`	unaffected	generic	—
`[6.12.108,6.13.0)`	unaffected	semver	—
`[6.18.49,6.19.0)`	unaffected	semver	—
`[7.1.13,7.2.0)`	unaffected	semver	—
`[7.2.3,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.195% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1e995498d29784a06a2b2899370a1926cfc8410d
https://git.kernel.org/stable/c/3d950e98f74af9611925a5226edced02155f6ed1
https://git.kernel.org/stable/c/498386b6d402737db1e2eeed4c385acbf0ef9e34
https://git.kernel.org/stable/c/5f77ddb2756340c1b05381674ca025d52998005e
https://git.kernel.org/stable/c/6df4f05bc2991467939d7d80b6f7e121559cc3df
https://git.kernel.org/stable/c/6e5472c1c1619793cbadb02bccf7d2d9f826052f
https://git.kernel.org/stable/c/b4ac2a5ce5a96ec21ed48f60d30b52b1fb22c62a
https://git.kernel.org/stable/c/d8ebf8875fb97b3e39aa226af78f9c619e96ee31
https://git.kernel.org/stable/c/d9a83492ffc99f228d91873473e3820300525f00

History

Oct 30, 2026 12:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/6e5472c1c1619793cbadb02bccf7d2d9f826052f https://git.kernel.org/stable/c/d8ebf8875fb97b3e39aa226af78f9c619e96ee31 https://git.kernel.org/stable/c/d9a83492ffc99f228d91873473e3820300525f00

Oct 3, 2026 11:15 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/b4ac2a5ce5a96ec21ed48f60d30b52b1fb22c62a

Sep 4, 2026 4:00 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: gtp: serialize PDP context updates PDP contexts can be deleted through GTP_CMD_DELPDP or while the GTP network device is being unregistered. The latter is serialized by RTNL, but the generic-netlink delete path only holds RCU. Running both paths concurrently can therefore make both paths delete the same PDP context. The issue was found through static analysis and reproduced on a KASAN-enabled kernel by a simple two-thread program racing GTP_CMD_DELPDP against RTM_DELLINK: Oops: general protection fault, probably for non-canonical address KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] RIP: gtp_genl_del_pdp+0x1c1/0x420 [gtp] RBP: dead000000000122 The second deletion dereferenced the poisoned hlist pprev pointer. Serialize gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink() with a shared mutex. Keep the mutex held until the final use of a PDP context in the NEWPDP path, and keep the RCU read-side section around the complete PDP context use in the DELPDP path.
Title		gtp: serialize PDP context updates
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1e995498d29784a06a2b2899370a1926cfc8410d https://git.kernel.org/stable/c/3d950e98f74af9611925a5226edced02155f6ed1 https://git.kernel.org/stable/c/498386b6d402737db1e2eeed4c385acbf0ef9e34 https://git.kernel.org/stable/c/5f77ddb2756340c1b05381674ca025d52998005e https://git.kernel.org/stable/c/6df4f05bc2991467939d7d80b6f7e121559cc3df