CVE-2026-75894: osmo-iuh Denial of Service Vulnerability

CVE-2026-75894 Overview

CVE-2026-75894 is a reachable assertion vulnerability in osmo-iuh, the OsmoCOM implementation of the Iuh interface used in 3G cellular networks. Versions 0.1.0 through 1.8.0 are affected. The flaw resides in the ranap_handle_co_dt() function, which processes RANAP (Radio Access Network Application Part) messages. An arbitrarily sized NAS-PDU (Non-Access Stratum Protocol Data Unit) triggers an assertion failure, causing the process to crash. Remote unauthenticated attackers can exploit the flaw over the network to produce a denial-of-service condition on the affected telecom infrastructure component.

Critical Impact
Unauthenticated remote attackers can crash osmo-iuh processes by sending a malformed NAS-PDU, disrupting 3G Iuh signaling and connected subscriber services.

Affected Products

OsmoCOM osmo-iuh version 0.1.0
OsmoCOM osmo-iuh versions between 0.1.0 and 1.8.0
OsmoCOM osmo-iuh version 1.8.0

Discovery Timeline

2026-09-18 - CVE-2026-75894 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-75894

Vulnerability Analysis

The vulnerability is classified as a reachable assertion [CWE-617]. The ranap_handle_co_dt() function handles connection-oriented Direct Transfer messages carrying NAS-PDUs between the RNC (Radio Network Controller) and the core network. The function contains an assertion on the size of the NAS-PDU that an attacker can violate by sending an arbitrarily sized payload. When the assertion fires, the process aborts, terminating active Iuh signaling and severing subscriber sessions handled by that instance.

Because the assertion is reachable from network input without prior authentication, any peer capable of sending RANAP messages to the vulnerable endpoint can trigger the crash. Repeated exploitation prevents the service from staying online, producing a sustained denial of service across the affected 3G interface.

Root Cause

The root cause is missing input validation on NAS-PDU length prior to a code path that relies on an assertion for correctness. Assertions are intended to catch programmer errors, not to gate untrusted network input. Treating attacker-controlled data as if it were internally validated allows a malformed PDU to reach the check and abort the process. The upstream fix is in commit f06967126f486bcb185ccf3d1a8f9bc02c4da1f6 in the OsmoCOM osmo-iuh repository.

Attack Vector

Exploitation requires network reachability to a vulnerable osmo-iuh instance and the ability to deliver a crafted RANAP message containing an oversized NAS-PDU. No authentication, user interaction, or elevated privileges are required. The vulnerability does not expose confidentiality or integrity of data; the impact is limited to availability of the Iuh signaling process. See the OsmoCOM Git Commit for the corrective patch.

No public proof-of-concept exploit is currently referenced in the CVE data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS score is 0.549%.

Detection Methods for CVE-2026-75894

Indicators of Compromise

Unexpected termination of the osmo-iuh process with an assertion-failure message in system logs or core dumps.
Sudden loss of Iuh signaling between the RNC and the SGSN or MSC, followed by immediate service restart cycles.
Inbound RANAP Direct Transfer messages carrying NAS-PDUs of unusual or oversized length from unexpected peers.

Detection Strategies

Monitor process supervisors (systemd, runit) for repeated osmo-iuh restarts and non-zero exit codes indicative of abort().
Inspect RANAP traffic with protocol-aware tooling to flag NAS-PDU length fields that exceed expected maxima.
Correlate crash events with source IP addresses of the RANAP peers active at the moment of the abort.

Monitoring Recommendations

Alert on any assertion or SIGABRT signals emitted by osmo-iuh processes.
Track availability metrics for the Iuh interface and set thresholds for uptime regressions.
Log and retain full RANAP message captures at edges facing untrusted RNCs to support post-incident analysis.

How to Mitigate CVE-2026-75894

Immediate Actions Required

Upgrade osmo-iuh to a version containing commit f06967126f486bcb185ccf3d1a8f9bc02c4da1f6 or later.
Restrict network access to the Iuh signaling port so that only trusted RNC peers can reach the service.
Enable automatic process supervision to restore the service after unexpected termination while a patch is deployed.

Patch Information

The upstream fix is available in the OsmoCOM osmo-iuh repository as commit f06967126f486bcb185ccf3d1a8f9bc02c4da1f6. Operators building from source should rebase onto or cherry-pick this commit and redeploy. Distribution package maintainers should track the vendor advisory for a tagged release beyond 1.8.0. Reference: OsmoCOM Git Commit.

Workarounds

Place network ACLs or firewall rules in front of the Iuh interface to permit only known RNC source addresses.
Deploy IPsec or another authenticated transport between RNC and core-network elements to eliminate untrusted peers.
Segment the signaling network from general enterprise and internet-facing zones to reduce exposure.

bash

# Example nftables rule limiting Iuh signaling access to trusted RNC peers
nft add rule inet filter input ip saddr != { 10.20.30.0/24 } \
    tcp dport { 29169 } drop