CVE-2026-98849 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
pfcp: fix socket lifetime on netdevice registration failure
pfcp_newlink() creates the UDP socket before register_netdevice(). If registration fails after pfcp_dev_init() succeeds, the core calls pfcp_dev_uninit(), which releases the socket and clears pfcp->sk. The newlink error path then releases it again, causing a NULL pointer dereference. This was observed with failslab fault injection:
FAULT_INJECTION: forcing a failure. kobject: kobject_add_internal failed for pfcp0 (error: -12 parent: net) BUG: KASAN: null-ptr-deref in udp_tunnel_sock_release+0x1c/0x50 Read of size 8 at addr 0000000000000120 by task ip/1037 Call trace: show_stack+0x18/0x24 (C) dump_stack_lvl+0x78/0x90 print_report+0x468/0x5cc kasan_report+0xa4/0xf0 __asan_load8+0x7c/0xd0 udp_tunnel_sock_release+0x1c/0x50 pfcp_newlink+0x128/0x184 rtnl_newlink+0x848/0xe44 rtnetlink_rcv_msg+0x468/0x514 netlink_rcv_skb+0xc0/0x1f0 rtnetlink_rcv+0x18/0x24 netlink_unicast+0x4b8/0x558 netlink_sendmsg+0x2b8/0x584 ...
Return from pfcp_del_sock() if pfcp->sk is NULL.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The PFCP protocol implementation within the Linux kernel contains a critical resource management flaw in its network device registration sequence, specifically affecting the handling of UDP sockets during initialization failures. The vulnerability arises from an incorrect ordering and cleanup logic in the pfcp_newlink function, which is responsible for creating new virtual interfaces that support Packet Forwarding Control Protocol traffic. During this process, the kernel allocates a UDP socket to facilitate communication before attempting to register the network device with the core networking subsystem via register_netdevice. This sequence creates a dependency where the validity of the allocated resources relies on the success of subsequent initialization steps, particularly pfcp_dev_init and the final registration call.
When the netdevice registration fails after pfcp_dev_init has successfully executed, the kernel's error handling mechanism invokes pfcp_dev_uninit to clean up partially initialized state. This function correctly releases the previously created UDP socket by calling release_sock or similar cleanup routines and explicitly clears the pointer pfcp->sk to NULL, indicating that no valid socket is currently associated with this device instance. However, the subsequent execution of the newlink error path contains a redundant cleanup step that attempts to free the same socket again without verifying whether it has already been released. This double-free scenario leads directly to a null pointer dereference because pfcp->sk is now NULL, and the code proceeds to access memory through this invalid reference in functions such as udp_tunnel_sock_release.
The operational impact of this vulnerability includes kernel panics or system crashes when triggered under specific failure conditions, effectively resulting in a denial of service for the affected host. The issue was identified using fault injection tools like failslab, which simulate allocation failures to expose race conditions and improper error handling paths that are difficult to reproduce through normal usage patterns. Such instability can disrupt network connectivity services relying on PFCP interfaces, particularly in environments where virtual interface creation is frequent or subject to resource constraints. The crash manifests as a KASAN null pointer dereference report, highlighting the memory corruption aspect of the bug and confirming the invalid access at address zero offset within the socket structure.
From a security classification perspective, this vulnerability aligns with CWE-416, Use After Free, although in this specific instance it presents primarily as a NULL Pointer Dereference (CWE-476) due to accessing freed or uninitialized memory after the pointer has been cleared. The attack vector is local and requires privileges capable of triggering netlink messages for network device creation, such as CAP_NET_ADMIN. In terms of MITRE ATT&CK mapping, this falls under Defense Evasion techniques involving resource hijacking or denial of service via system instability, specifically within the context of kernel exploitation where an attacker might leverage repeated allocation failures to induce crashes and potentially escalate privileges if other vulnerabilities are present in the surrounding code path.
The resolution involves modifying pfcp_newlink to check for a NULL pointer before attempting to release the socket again. By returning early from pfcp_del_sock or equivalent cleanup routines when pfcp->sk is found to be NULL, the kernel prevents the double-free condition and ensures that resources are managed consistently regardless of whether registration succeeds or fails. This fix reinforces proper state management practices in network driver development, ensuring that error paths do not assume ownership of resources they have already relinquished. Administrators should apply this patch immediately to maintain system stability, particularly in deployments where PFCP interfaces are dynamically created and destroyed under varying load conditions. Regular updates to the kernel ensure that such race conditions and logic errors in resource lifecycle management are addressed before they can be exploited or cause unintended service interruptions.