CVE-2026-25501: Free5gc SMF DOS Vulnerability

CVE-2026-25501 Overview

CVE-2026-25501 is a Null Pointer Dereference vulnerability affecting free5GC SMF, the Session Management Function component for free5GC, an open-source project implementing 5th generation (5G) mobile core networks. The vulnerability allows remote attackers to cause a denial of service by sending malformed PFCP SessionReportRequest messages to the SMF PFCP interface on UDP port 8805, resulting in process termination due to a nil pointer dereference panic.

Critical Impact

Remote attackers can crash the SMF component of 5G core networks without authentication, causing service disruption to 5G mobile network operations.

Affected Products

• free5GC SMF versions up to and including 1.4.1

Discovery Timeline

• 2026-02-24 - CVE CVE-2026-25501 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-25501

Vulnerability Analysis

This vulnerability stems from improper input validation in the PFCP (Packet Forwarding Control Protocol) message handling code within free5GC SMF. When the SMF component receives a malformed PFCP SessionReportRequest message on its PFCP interface (UDP/8805), the handler attempts to dereference a nil pointer, causing a Go runtime panic that terminates the entire SMF process.

The vulnerability has network-based attack vector characteristics, requiring no privileges or user interaction to exploit. While the confidentiality and integrity impacts are limited, the availability impact is significant as it can take down the Session Management Function, a critical component in 5G core network architecture responsible for PDU session establishment, modification, and release.

Root Cause

The root cause is a missing nil pointer check in the PFCP SessionReportRequest handler (CWE-476). The Go code fails to validate that certain expected fields in the incoming PFCP message are present before attempting to access them. When a malformed request arrives without these expected fields, the code attempts to dereference a nil pointer, triggering a panic that propagates and terminates the process since no recovery mechanism is in place for the PFCP handler dispatch.

Attack Vector

The attack vector is network-based, targeting the PFCP interface on UDP port 8805. An attacker can craft a malformed PFCP SessionReportRequest message that omits required fields or contains invalid data structures. When this message reaches the SMF component, the vulnerable handler processes it without proper validation, leading to the nil pointer dereference.

The attack does not require authentication or any special privileges, as PFCP is designed for communication between network functions within the 5G core. However, in properly segmented deployments, the PFCP interface should only be accessible from trusted User Plane Function (UPF) nodes.

The vulnerability manifests in the PFCP message handler dispatch logic where incoming SessionReportRequest messages are processed. See the GitHub Security Advisory GHSA-vq85-8f6p-g9q5 for additional technical details.

Detection Methods for CVE-2026-25501

Indicators of Compromise

• SMF process crashes or unexpected terminations in system logs
• Go panic stack traces referencing nil pointer dereference in PFCP handler code
• Unusual PFCP traffic patterns on UDP/8805, particularly malformed SessionReportRequest messages
• Service disruption affecting PDU session management in the 5G core

Detection Strategies

• Monitor SMF process health and implement alerting on unexpected process terminations
• Deploy network intrusion detection rules to identify malformed PFCP messages targeting UDP/8805
• Analyze PFCP traffic logs for SessionReportRequest messages with missing or invalid mandatory fields
• Implement application-level logging to capture PFCP message parsing errors before they cause panics

Monitoring Recommendations

• Set up process monitoring for the SMF component with automatic restart capabilities
• Configure network monitoring to baseline normal PFCP traffic patterns and alert on anomalies
• Enable debug-level logging on the PFCP interface during investigation periods to capture malformed message details
• Monitor for repeated SMF crashes that may indicate active exploitation attempts

How to Mitigate CVE-2026-25501

Immediate Actions Required

• Implement firewall or ACL rules to restrict PFCP interface (UDP/8805) access to only trusted UPF IP addresses
• Deploy network edge inspection to drop or filter malformed PFCP SessionReportRequest messages where feasible
• Add recover() mechanisms around PFCP handler dispatch in your local deployment to prevent whole-process termination
• Reduce the attack surface by ensuring proper network segmentation between 5G core components

Patch Information

No known upstream fix is currently available for this vulnerability. The free5GC project has documented the issue in GitHub Issue #805 and the GitHub Security Advisory GHSA-vq85-8f6p-g9q5. Organizations should monitor these resources for updates on an official patch release.

Workarounds

• Apply ACL/firewall rules to ensure only trusted UPF IP addresses can reach the SMF PFCP interface on UDP/8805
• Implement network edge filtering to inspect and drop malformed PFCP SessionReportRequest messages
• Add Go recover() wrapper around PFCP handler dispatch code to catch panics and prevent process termination (mitigation only, does not fix the underlying issue)
• Consider deploying SMF instances behind a PFCP-aware proxy or gateway that can validate message integrity

# Example iptables rule to restrict PFCP access to trusted UPF
iptables -A INPUT -p udp --dport 8805 -s <TRUSTED_UPF_IP> -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP