CVE-2026-80851: Linux Kernel GTP Race Condition Vulnerability

CVE-2026-80851 Overview

CVE-2026-80851 is a race condition in the Linux kernel's GPRS Tunnelling Protocol (GTP) subsystem. The flaw allows concurrent deletion of the same Packet Data Protocol (PDP) context through two independent code paths. The GTP_CMD_DELPDP generic-netlink command holds only an RCU read lock, while gtp_dellink() runs under RTNL during network device unregistration. Racing these paths causes a double-free of the PDP context and dereferences a poisoned hlist pointer, resulting in a kernel general protection fault.

Critical Impact
Local users with CAP_NET_ADMIN can trigger a kernel general protection fault, leading to denial of service and potential memory corruption in the GTP networking module.

Affected Products

Linux kernel versions containing the GTP subsystem prior to the fixed commits
Distributions shipping GTP module (gtp.ko) for mobile core network deployments
Stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-09-04 - CVE-2026-80851 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80851

Vulnerability Analysis

The GTP kernel module manages PDP contexts that represent active mobile data sessions between the kernel and user-space GTP tunnel endpoints. Two independent code paths can delete a PDP context. The first is gtp_genl_del_pdp(), invoked by the GTP_CMD_DELPDP generic-netlink command, which relies only on RCU read-side protection. The second is gtp_dellink(), executed when the GTP network device is unregistered under the Routing Netlink (RTNL) mutex.

Because the two paths do not share a mutual exclusion primitive, a two-thread program racing GTP_CMD_DELPDP against RTM_DELLINK can enter both deletion routines for the same context. The second thread unlinks a PDP entry whose hlist pointers have already been poisoned, producing the reported general protection fault at gtp_pdp_add+0x1c1/0x420 with RBP: dead000000000122. This is a classic race condition falling under Time-of-Check Time-of-Use (TOCTOU) semantics for shared kernel data structures.

Root Cause

The root cause is inconsistent locking between the netlink command handlers and the netdev lifecycle handlers in drivers/net/gtp.c. RCU alone protects readers from freed memory but does not serialize concurrent writers. Two concurrent writers therefore observe the same PDP context as live and both attempt to unlink it.

Attack Vector

An attacker with the ability to issue GTP generic-netlink commands and manage network devices, typically a local user holding CAP_NET_ADMIN in the relevant network namespace, can trigger the race. The reproducer described in the commit message uses two threads: one repeatedly invoking GTP_CMD_DELPDP and another repeatedly issuing RTM_DELLINK against the GTP interface. See the upstream fix commits for technical details, including Kernel Git Commit 6df4f05 and Kernel Git Commit 498386b.

Detection Methods for CVE-2026-80851

Indicators of Compromise

Kernel oops entries referencing gtp_genl_del_pdp or gtp_pdp_add with poisoned pointer values such as dead000000000122.
KASAN reports indicating wild-memory-access inside the gtp module address range.
Unexpected crashes or reboots on hosts running mobile core workloads that use the GTP module.

Detection Strategies

Monitor dmesg and journalctl -k for general protection fault messages naming symbols exported by gtp.ko.
Correlate crash timestamps with recent RTM_DELLINK and GTP_CMD_DELPDP netlink activity captured by audit or eBPF tracepoints.
Track processes holding CAP_NET_ADMIN that interact with the GTP generic-netlink family.

Monitoring Recommendations

Enable kernel crash dumps (kdump) on GTP-enabled hosts to capture stack traces for post-incident analysis.
Instrument netlink_sendmsg and GTP netlink command IDs using eBPF to baseline expected control-plane behavior.
Alert on repeated netlink deletion commands originating from non-orchestrator processes.

How to Mitigate CVE-2026-80851

Immediate Actions Required

Apply the upstream stable kernel patches that introduce the shared mutex serializing gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink().
If patching is not immediately possible, unload the gtp module (modprobe -r gtp) on hosts where GTP is not required.
Restrict CAP_NET_ADMIN in network namespaces exposed to untrusted workloads.

Patch Information

The fix serializes the three PDP context mutation paths with a shared mutex, holds the mutex until the final use of the PDP context in the NEWPDP path, and keeps the RCU read-side critical section wrapped around the complete PDP context use in the DELPDP path. Patched commits are available at Kernel Git Commit 1e99549, Kernel Git Commit 3d950e9, Kernel Git Commit 498386b, Kernel Git Commit 5f77ddb, and Kernel Git Commit 6df4f05.

Workarounds

Blacklist the gtp module on systems that do not require mobile core tunneling functionality.
Use module signing and modprobe.d blacklists to prevent automatic loading of gtp.ko.
Constrain container and VM workloads so that only trusted orchestration components can issue GTP netlink commands.

bash

# Blacklist the GTP module until the kernel is patched
echo 'blacklist gtp' | sudo tee /etc/modprobe.d/blacklist-gtp.conf
sudo modprobe -r gtp || true
sudo update-initramfs -u