CVE-2026-89789 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
gtp_newlink()'s error path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing sk_user_data. A concurrent gtp_encap_recv() in softirq may still hold the gtp_dev pointer obtained via rcu_dereference_sk_user_data() and access the freed memory.
BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152) Call Trace: <IRQ> gtp0_pdp_find+0x1f6/0x200 gtp_encap_recv+0x527/0x24b0 udp_queue_rcv_one_skb+0x75f/0xc10
Add synchronize_net() before the kfree calls in out_hashtable, which covers all error paths from both gtp_encap_enable() and gtp_create_sockets().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel's Generic Tunneling Protocol (GTP) implementation contains a critical concurrency flaw within its network device creation logic. Specifically, the function responsible for initializing new GTP links fails to properly manage Read-Copy-Update synchronization during error handling sequences. When the initialization process encounters an exception and transitions to an error path, it proceeds immediately to release allocated memory resources without ensuring that all concurrent read-side critical sections have completed their execution cycles. This oversight creates a window where kernel data structures are deallocated while they may still be actively referenced by other parts of the networking stack operating in software interrupt context.
The technical root cause lies in the improper ordering of resource cleanup relative to RCU grace periods. The code clears user-specific socket data and subsequently frees hash tables containing device pointers without invoking synchronize_net(). This function is essential for blocking until all pre-existing RCU read-side critical sections have finished, thereby guaranteeing that no CPU holds a reference to the freed memory. Without this synchronization barrier, concurrent packet processing routines can retrieve stale pointers via rcu_dereference_sk_user_data() and attempt to access memory regions that have already been returned to the slab allocator for reuse by other kernel allocations.
This vulnerability manifests as a use-after-free condition detectable through Kernel Address Sanitizer (KASAN) reports. The exploitation scenario typically involves triggering an error during GTP link creation while simultaneous network traffic is being processed on existing or related interfaces. A softirq handler, specifically gtp_encap_recv(), may execute concurrently with the cleanup routine and dereference a pointer to the now-freed tid_hash or addr_hash structures. This leads to memory corruption, potential kernel panics, or unpredictable system behavior as the freed slab space might have been reallocated for unrelated purposes, causing data integrity violations when accessed through stale pointers.
From an industry standard perspective, this flaw is classified under CWE-416: Use After Free. It represents a classic race condition where timing dependencies between memory deallocation and concurrent access lead to undefined behavior. In the context of the MITRE ATT&CK framework for enterprise security, such vulnerabilities fall under Tactic 7: Discovery or Tactic 3: Persistence if leveraged for privilege escalation, though primarily they serve as vectors for Denial of Service through system instability. The lack of proper synchronization violates fundamental principles of safe concurrent programming in kernel space, where memory safety must be guaranteed across all execution contexts including interrupt handlers and softirqs.
The operational impact of this vulnerability includes severe stability degradation on systems utilizing GTP interfaces, which are commonly deployed in mobile network gateways and virtualized infrastructure environments. An attacker or even a benign misconfiguration could trigger the error path repeatedly to induce repeated use-after-free conditions, leading to kernel crashes that disrupt critical telecommunications services. Furthermore, if an adversary can control the contents of the freed memory through prior allocation patterns, they might achieve arbitrary code execution by manipulating what gets allocated in place of the hash tables before the stale pointer is dereferenced.
Mitigation requires applying the upstream Linux kernel patch that introduces synchronize_net() calls within the error handling paths of gtp_newlink(). This ensures that all pending RCU read-side critical sections complete before memory is released, effectively closing the race window. Administrators should ensure their systems are updated with kernels containing this fix. Additionally, deploying KASAN in testing environments can help identify similar synchronization issues early in development cycles by detecting illegal accesses to freed slab objects during fuzzing or stress testing of network subsystems.