CVE-2026-64577: Linux Kernel GTP Module DoS Vulnerability

CVE-2026-64577 Overview

CVE-2026-64577 is a Linux kernel vulnerability in the GPRS Tunnelling Protocol (GTP) driver at drivers/net/gtp.c. The function gtp1u_send_echo_resp() ignores the return value of skb_pull_data(). Its caller gtp1u_udp_encap_recv() only guarantees 16 bytes (udphdr + gtp1_header), while the pull requests 20 bytes (gtp1_header_long + udphdr). For an echo request between 16 and 19 bytes, the pull fails and returns NULL without advancing skb->data. Execution continues, and a subsequent skb_push() combined with the IP header pushed by iptunnel_xmit() moves skb->data below skb->head, tripping skb_under_panic() and causing a kernel panic.

Critical Impact
A remote attacker can send a malformed GTP-U echo request to trigger skb_under_panic(), causing a fatal kernel BUG and denial of service on hosts running the GTP tunnel driver.

Affected Products

Linux kernel versions containing the vulnerable gtp1u_send_echo_resp() implementation in drivers/net/gtp.c
Systems with the GTP kernel module (gtp) loaded, typically mobile core network gateways and 4G/5G user plane deployments
Stable kernel branches fixed via commits 4fc7923, 961e9b1, b3c733e, cd170f0, and cf45d74

Discovery Timeline

2026-08-05 - CVE-2026-64577 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-64577

Vulnerability Analysis

The defect resides in the GTP-U (GTP User Plane) echo response handling path within the Linux kernel networking stack. When gtp1u_udp_encap_recv() receives a UDP-encapsulated GTP packet, it verifies only 16 bytes of headroom, corresponding to a udphdr plus a short gtp1_header. It then invokes gtp1u_send_echo_resp() to build a reply. The response builder calls skb_pull_data() requesting 20 bytes to cover a gtp1_header_long in addition to the UDP header. The function does not check whether the pull succeeds.

When an attacker sends an echo request whose payload is only 16 to 19 bytes, skb_pull_data() returns NULL and leaves skb->data untouched. The code path proceeds unaware of the failure. A later skb_push() grows the header area, and iptunnel_xmit() pushes an outer IP header. The cumulative pushes drive skb->data below skb->head, which the SKB accounting invariants forbid. The kernel raises skb_under_panic() at net/core/skbuff.c:214, producing kernel BUG and a fatal exception in interrupt context.

Root Cause

The root cause is missing return-value validation on skb_pull_data(). The caller's length precondition covers only the short GTP header form, but the response path assumes the long form. This mismatch between validated headroom and requested pull length constitutes an input validation error that manifests as a kernel-level denial of service.

Attack Vector

An attacker with network reach to a GTP-U endpoint (UDP port 2152 in typical deployments) can craft a truncated GTP echo request between 16 and 19 bytes. Delivery of a single malformed packet causes the receiving host to panic. No authentication is required because GTP-U itself does not authenticate peers at the protocol layer. The vulnerability affects hosts acting as GTP tunnel endpoints, such as mobile packet gateways, test rigs, and lab systems that load the gtp module.

See the Kernel Git Commit 4fc7923 for the upstream fix that adds the missing NULL check and drops packets on pull failure.

Detection Methods for CVE-2026-64577

Indicators of Compromise

Kernel log entries containing skb_under_panic originating from skb_push and iptunnel_xmit in the gtp_encap_recv call chain
Unexpected kernel panics or reboots on hosts with the gtp module loaded, correlated with inbound UDP traffic to port 2152
Presence of small (16 to 19 byte) GTP-U echo request payloads captured on the wire preceding a host crash

Detection Strategies

Monitor kernel ring buffer output (dmesg, journalctl -k) for skb_under_panic and Fatal exception in interrupt messages referencing gtp_encap_recv
Inspect network telemetry for undersized GTP-U packets with echo request message type directed at tunnel endpoints
Correlate host availability alerts with GTP module load state using inventory data from endpoint agents

Monitoring Recommendations

Alert on any kernel BUG or oops on production GTP nodes, treating a single event as suspicious
Track UDP flows to port 2152 for anomalous packet size distributions, especially bursts of sub-20-byte payloads
Maintain crash-dump collection (kdump) on GTP-facing hosts to preserve forensic evidence after a panic

How to Mitigate CVE-2026-64577

Immediate Actions Required

Apply the upstream stable kernel patch that adds the return-value check in gtp1u_send_echo_resp() and drops packets when skb_pull_data() fails
Restrict inbound UDP traffic to port 2152 to trusted GTP peers using firewall rules on the host and upstream network devices
Unload the gtp kernel module on systems that do not require GTP tunnelling: modprobe -r gtp

Patch Information

The fix drops the packet when skb_pull_data() returns NULL, preventing the subsequent skb_push() from underflowing skb->head. Relevant stable commits include Kernel Git Commit 4fc7923, Kernel Git Commit 961e9b1, Kernel Git Commit b3c733e, Kernel Git Commit cd170f0, and Kernel Git Commit cf45d74. Rebuild and reboot affected kernels to activate the fix.

Workarounds

Blacklist the gtp module on hosts that do not need mobile tunnel functionality by adding blacklist gtp to /etc/modprobe.d/
Enforce ingress filtering on GTP-U endpoints to drop UDP packets to port 2152 whose payload is smaller than the full gtp1_header_long size
Segment GTP control and user plane interfaces onto isolated networks reachable only from validated peer elements

bash

# Configuration example: block undersized GTP-U traffic and unload the module on non-GTP hosts
# Drop UDP/2152 packets below 20 bytes of payload (adjust interface as needed)
iptables -A INPUT -p udp --dport 2152 -m length --length 0:47 -j DROP

# Prevent the vulnerable module from loading on hosts that do not require GTP
echo 'blacklist gtp' | sudo tee /etc/modprobe.d/disable-gtp.conf
sudo modprobe -r gtp