CVE-2026-64577 in Linux
Summary
by MITRE • 08/05/2026
In the Linux kernel, the following vulnerability has been resolved:
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
gtp1u_send_echo_resp() ignores skb_pull_data()'s return value. Its caller gtp1u_udp_encap_recv() only guarantees 16 bytes (udphdr + gtp1_header), but the pull requests 20 (gtp1_header_long + udphdr). For a 16-19 byte echo request the pull fails and returns NULL without advancing skb->data; execution continues, and the following skb_push() plus the IP header pushed by iptunnel_xmit() move skb->data below skb->head, tripping skb_under_panic().
Fix it by dropping the packet when skb_pull_data() fails.
skbuff: skb_under_panic: ... kernel BUG at net/core/skbuff.c:214! Call Trace: skb_push (net/core/skbuff.c:2648) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:82) gtp_encap_recv (drivers/net/gtp.c:701 drivers/net/gtp.c:808 drivers/net/gtp.c:920) udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) ... Kernel panic - not syncing: Fatal exception in interrupt
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability exists within the Linux kernel's GTP (GPRS Tunneling Protocol) implementation, specifically in the gtp1u_send_echo_resp() function where improper error handling leads to a critical memory corruption scenario. This flaw affects the gtp driver module responsible for handling GTPv1U protocol packets in LTE networks and other mobile infrastructure deployments. The issue manifests when processing echo response packets through the GTP encapsulation mechanism, creating a condition where kernel memory integrity is compromised.
The technical root cause involves a fundamental flaw in the skb_pull_data() function call within gtp1u_send_echo_resp(). The function ignores the return value from skb_pull_data() which is essential for validating memory operations. When gtp1u_udp_encap_recv() processes incoming packets, it only guarantees a minimum of 16 bytes including UDP header and GTPv1 header, but the code attempts to pull 20 bytes total. This discrepancy occurs when handling echo requests that are between 16-19 bytes in length, causing skb_pull_data() to return NULL without advancing the skb->data pointer.
The operational impact of this vulnerability is severe as it triggers a kernel panic and system crash due to memory corruption. When skb_pull_data() fails, the subsequent skb_push() operation and the IP header manipulation by iptunnel_xmit() cause the skb->data pointer to move below the valid memory region defined by skb->head. This condition violates kernel memory safety mechanisms and triggers the skb_under_panic() check in net/core/skbuff.c at line 214, ultimately resulting in a fatal kernel exception during interrupt handling.
The vulnerability aligns with CWE-129: Improper Validation of Array Index and CWE-787: Out-of-bounds Write, representing memory corruption issues that can be exploited for privilege escalation or denial-of-service attacks. From an ATT&CK perspective, this maps to T1499.004: Endpoint Denial of Service and potentially T1566.001: Phishing via Social Engineering when considering how attackers might leverage such kernel-level vulnerabilities. The fix implements defensive programming by dropping packets immediately when skb_pull_data() fails, preventing further execution down the corrupted memory path.
This vulnerability demonstrates the critical importance of proper error handling in kernel network drivers where memory operations must be validated before proceeding with subsequent processing steps. The fix ensures that packet processing terminates gracefully when memory constraints cannot be satisfied, preventing potential exploitation by malicious actors who might craft specially crafted GTP packets to trigger this condition. The resolution addresses a fundamental race condition between expected packet sizes and actual memory allocation in kernel network stack operations, maintaining system stability while preserving legitimate packet processing functionality.
The security implications extend beyond immediate system crashes to potential privilege escalation vectors, as kernel memory corruption can be exploited to execute arbitrary code with kernel privileges. Network infrastructure devices relying on GTP support for mobile backhaul communications are particularly vulnerable, including LTE base stations, MME (Mobility Management Entity) servers, and other network elements implementing GTPv1U protocol handling. Organizations deploying Linux-based systems for telecommunications infrastructure should prioritize applying this patch to prevent potential exploitation that could compromise entire network domains through kernel-level attacks.