CVE-2026-42801: ASR Crane/Falcon Use-After-Free Vulnerability

CVE-2026-42801 Overview

CVE-2026-42801 is a NULL pointer dereference vulnerability affecting the ASR Crane and Falcon platforms running Linux. The flaw resides in the as_rrc module, specifically within the program file 3g.mod/lib/src/urrsir.c. An authenticated attacker on the network can trigger pointer manipulation that dereferences a NULL pointer, causing a crash of the affected component. The vulnerability is classified under [CWE-476: NULL Pointer Dereference] and affects confidentiality, integrity, and availability at a low level while impacting a scope beyond the vulnerable component.

Critical Impact
A network-adjacent attacker with low privileges can trigger a crash in the 3G radio resource control (RRC) module, disrupting cellular baseband processing on affected ASR Crane and Falcon Linux platforms.

Affected Products

ASR Crane on Linux (as_rrc module)
ASR Falcon on Linux (as_rrc module)
Vulnerable component: 3g.mod/lib/src/urrsir.c

Discovery Timeline

2026-09-23 - CVE-2026-42801 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-42801

Vulnerability Analysis

The vulnerability exists in the as_rrc module of the ASR Crane and Falcon baseband software stacks. The as_rrc component implements Radio Resource Control signaling for the 3G modem stack. The defect is located in 3g.mod/lib/src/urrsir.c, which handles UMTS RRC signaling information records. When the module processes crafted input, it dereferences a pointer without first validating that the pointer is non-NULL. The resulting access to address zero terminates the affected process or subsystem. Because the CVSS scope is Changed, the failure propagates beyond the vulnerable component and affects other parts of the platform.

Root Cause

The root cause is missing pointer validation before dereference, matching the [CWE-476] pattern. Code paths inside urrsir.c assume that structure pointers returned by upstream parsing or allocation routines are always valid. When those routines return NULL, for example due to malformed signaling or resource pressure, subsequent field accesses trigger a fault. The as_rrc module does not implement defensive NULL checks or graceful error handling on these paths.

Attack Vector

The attack vector is network-based with low attack complexity. An attacker requires low privileges and no user interaction to reach the vulnerable code path. Exploitation involves sending crafted RRC signaling to the affected device, causing the as_rrc module to process malformed data and dereference a NULL pointer. The result is a denial-of-service condition against the modem stack, with limited confidentiality and integrity impact stemming from the scope change. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. See the ASRMicro PSIRT Information for vendor technical details.

Detection Methods for CVE-2026-42801

Indicators of Compromise

Unexpected crashes, restarts, or watchdog resets of the as_rrc process or 3G modem subsystem on ASR Crane and Falcon platforms.
Kernel or system logs containing segmentation faults or NULL pointer dereference traces referencing urrsir.c or the as_rrc module.
Unexplained loss of 3G radio connectivity coinciding with anomalous RRC signaling.

Detection Strategies

Monitor baseband and RRC-layer logs for repeated fault signatures pointing at 3g.mod/lib/src/urrsir.c.
Correlate crash events with inbound signaling patterns to identify attacker-controlled triggers.
Deploy telemetry on device management channels to flag unusual RRC message sequences directed at affected devices.

Monitoring Recommendations

Centralize modem crash reports and platform watchdog events in a security data lake for longitudinal analysis.
Alert on abnormal frequency of as_rrc restarts across a fleet, which may indicate coordinated exploitation attempts.
Track vendor advisories from ASRMicro PSIRT for updated indicators and patch guidance.

How to Mitigate CVE-2026-42801

Immediate Actions Required

Inventory all deployments of ASR Crane and Falcon Linux platforms and confirm whether the as_rrc module is present and active.
Apply vendor-supplied firmware or software updates from ASRMicro as soon as they are made available.
Restrict network exposure of affected devices to trusted signaling paths and management networks only.

Patch Information

Refer to the ASRMicro PSIRT Information page for the authoritative list of fixed versions and remediation instructions. At publication, no specific fixed version is enumerated in the NVD record. Coordinate patch deployment with the vendor to obtain the corrected 3g.mod build for urrsir.c.

Workarounds

Segment affected devices onto isolated network zones to limit reachability from untrusted networks.
Enforce authentication controls that reduce the population of low-privileged users capable of interacting with the RRC signaling interface.
Implement upstream filtering or rate limiting of RRC signaling where the deployment architecture supports it, until a vendor patch is applied.

bash

# Configuration example
# Restrict management access to the affected ASR Crane/Falcon device
# to a trusted administrative subnet using host-based firewall rules.
iptables -A INPUT -s 10.0.10.0/24 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP