CVE-2026-75892: osmo-ggsn Buffer Overflow Vulnerability

CVE-2026-75892 Overview

CVE-2026-75892 is an out-of-bounds write vulnerability in osmo-ggsn version 1.14.0, an open-source GPRS Gateway Support Node (GGSN) implementation from the Osmocom project. The flaw exists in the gtp_decode_pdp_ctx() function, which parses Packet Data Protocol (PDP) context structures from GTP (GPRS Tunnelling Protocol) messages. When processing the GSN-Address sub-field within a PDP context, the function writes past the bounds of its destination buffer. This leads to memory corruption. The vulnerability is remotely reachable over the network without authentication or user interaction.

Critical Impact
A remote attacker can trigger memory corruption in osmo-ggsn by sending a crafted GTP message containing a malformed PDP context GSN-Address sub-field, potentially disclosing memory contents or corrupting adjacent process state.

Affected Products

Osmocom osmo-ggsn 1.14.0
GPRS core network deployments using the affected osmo-ggsn build
Any mobile core lab or production environment exposing GTP endpoints from vulnerable versions

Discovery Timeline

2026-09-18 - CVE-2026-75892 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-75892

Vulnerability Analysis

The vulnerability resides in gtp_decode_pdp_ctx(), the routine responsible for decoding PDP context information elements received in GTP signaling messages. A PDP context carries several sub-fields, including the GSN-Address that identifies the serving or gateway support node handling user-plane traffic. During decoding, the function writes attacker-influenced data derived from the GSN-Address sub-field into a fixed-size buffer without correctly validating the declared length against the destination capacity. The result is an out-of-bounds write classified under [CWE-787].

The access vector is network-based, complexity is low, and no privileges or user interaction are required. Confidentiality and integrity impacts are partial because the corruption is bounded by adjacent structures rather than yielding full process control in the observed conditions.

Root Cause

The root cause is missing or insufficient bounds checking on the length of the GSN-Address sub-field before it is copied into a statically sized field inside the decoded PDP context structure. The upstream fix in commit 6c322f4dd339401a437da3c89c95f2bf64bca995 corrects the length validation logic in the decoder.

Attack Vector

An attacker sends a crafted GTP message containing a PDP context information element with a manipulated GSN-Address sub-field length. When osmo-ggsn parses the message, gtp_decode_pdp_ctx() writes beyond the destination buffer. Because GTP typically runs over UDP on well-known ports (2123 for GTP-C, 2152 for GTP-U), any network position with reachability to the GGSN's signaling interface can deliver the payload. Refer to the Osmocom commit changeset for the exact code path and fix.

// No verified proof-of-concept code is published for CVE-2026-75892.
// See the upstream commit for the corrected bounds check.

Detection Methods for CVE-2026-75892

Indicators of Compromise

Unexpected crashes, restarts, or segmentation faults of the osmo-ggsn process on GGSN hosts.
GTP-C packets on UDP/2123 containing PDP context information elements with anomalous or oversized GSN-Address sub-field lengths.
Core dumps or systemd journal entries referencing gtp_decode_pdp_ctx in the call stack.

Detection Strategies

Deploy protocol-aware inspection at the GTP boundary to validate PDP context sub-field lengths against protocol specifications before packets reach the GGSN.
Enable verbose logging in osmo-ggsn and monitor for malformed message counters and decode errors originating from unknown peers.
Track outbound behavioral anomalies from GGSN hosts, as memory corruption can lead to abnormal process activity that endpoint telemetry can surface.

Monitoring Recommendations

Baseline the set of legitimate SGSN peers and alert on GTP traffic from unexpected source addresses on UDP/2123 and UDP/2152.
Forward osmo-ggsn logs and host telemetry to a centralized analytics platform for correlation with process crash events.
Alert on repeated PDP context decode failures within short time windows, which may indicate fuzzing or exploitation attempts.

How to Mitigate CVE-2026-75892

Immediate Actions Required

Upgrade osmo-ggsn past commit 6c322f4dd339401a437da3c89c95f2bf64bca995 from the upstream Osmocom repository.
Restrict network reachability to GTP-C (UDP/2123) and GTP-U (UDP/2152) so that only known SGSN and roaming partner peers can send traffic.
Inventory GGSN deployments and confirm the running version of osmo-ggsn to identify exposure.

Patch Information

The issue is fixed upstream in the Osmocom repository. Review and apply the changes in the Osmocom commit changeset, then rebuild and redeploy osmo-ggsn from a version containing this commit. Downstream distributions should track their packaging for a corresponding update.

Workarounds

Enforce strict access control lists on the GTP signaling interface, limiting UDP/2123 to trusted SGSN peers only.
Place a GTP-aware firewall or GTP firewall function in front of the GGSN to filter malformed PDP context information elements.
Run osmo-ggsn under a hardened service configuration with automatic restart and reduced privileges to contain the impact of a crash.

bash

# Example: restrict inbound GTP-C to trusted SGSN peers using nftables
nft add table inet gtp_filter
nft add chain inet gtp_filter input { type filter hook input priority 0 \; policy drop \; }
nft add rule inet gtp_filter input udp dport 2123 ip saddr { 203.0.113.10, 203.0.113.11 } accept
nft add rule inet gtp_filter input udp dport 2152 ip saddr { 203.0.113.10, 203.0.113.11 } accept