CVE-2026-89789

HighCVSS 7.8/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free

gtp_newlink()'s error path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing sk_user_data. A concurrent gtp_encap_recv() in softirq may still hold the gtp_dev pointer obtained via rcu_dereference_sk_user_data() and access the freed memory.

BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152) Call Trace: <IRQ> gtp0_pdp_find+0x1f6/0x200 gtp_encap_recv+0x527/0x24b0 udp_queue_rcv_one_skb+0x75f/0xc10

Add synchronize_net() before the kfree calls in out_hashtable, which covers all error paths from both gtp_encap_enable() and gtp_create_sockets().

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 459aa660eb1d8ce67080da1983bb81d716aa5a69, < fcafb2b1430824bae4258c01a439ec97ca0c6973; >= 459aa660eb1d8ce67080da1983bb81d716aa5a69, < 3ca3da5c305caa873ddb81e8c6b118143f6dd3d1; >= 459aa660eb1d8ce67080da1983bb81d716aa5a69, < 6f815c2fb6ab20385f81c353cdad0ea3b88132af; >= 459aa660eb1d8ce67080da1983bb81d716aa5a69, < e3b9aa0773abd5d4ed90be41ce5306c146d5b09e; >= 459aa660eb1d8ce67080da1983bb81d716aa5a69, < fd8396cfecbd904468c71362f08aaa25f96d5337; >= 459aa660eb1d8ce67080da1983bb81d716aa5a69, < 7677eb2cbf2cc7446de474c01a6b06277c0051e5; >= 459aa660eb1d8ce67080da1983bb81d716aa5a69, < 8d85498016a5bb56339734a14c276209fa65bafc; >= 459aa660eb1d8ce67080da1983bb81d716aa5a69, < d989e22ae9802c52c56ad4284d0caf26696cf6ae
LinuxLinux4.7

References

Timeline

Published
Sep 16, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-89799.3The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to an authentication bypass. An unauthenticated remote attacker can chCVE-2026-89790In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid divide by zero in rt6_multipath_rebalance rt6_multipath_reCVE-2026-897917.8In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap() revival races with the last mCVE-2026-897927.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds reads in share config responses Validate CVE-2026-897937.8In the Linux kernel, the following vulnerability has been resolved: ublk: clear VM_MAYWRITE on read-only ublk char device mmap ublk_ch_mmaCVE-2026-89794In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero pipe read compound padding Compound response handling exteCVE-2026-897958.4In the Linux kernel, the following vulnerability has been resolved: PCI: Allow per function PCI slots to fix slot reset on s390 On s390 syCVE-2026-89796In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid infinite kdamond_merge_regions() internal loop PaCVE-2026-89797In the Linux kernel, the following vulnerability has been resolved: power: supply: ab8500_fg: fix use-after-free on remove ab8500_fg_removCVE-2026-89798In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rn_done before publishing the notification rpcrdma_rn_regCVE-2026-897997.8In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_get_stackid The get_perf_callchain callCVE-2026-89809.3The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to privilege escalation. An authenticated low-privileged user can chan
CVE-2026-89789: High severity, CVSS 7.8 | Vulnix