Vulnerability in Linux Kernel GTP Module Affects Packet Processing

CVE-2026-64577

What is CVE-2026-64577?

A vulnerability exists in the Linux kernel's GTP module, specifically within the gtp1u_send_echo_resp() function. This function fails to properly check the return value of skb_pull_data(), which leads to potential packet handling issues. The function expects to receive a longer packet but is called with packets that may not meet this requirement, causing it to inadvertently proceed with NULL values. As a result, this oversight can lead to kernel panic by manipulating the sk_buff structure, ultimately disrupting network operations and creating a risk for system stability. The issue is resolved by ensuring that packets are dropped when the skb_pull_data() fails, thereby preventing errant execution and potential crashes.

References