CVE-2026-89789: Linux Kernel GTP Use-After-Free Vulnerability

CVE-2026-89789 Overview

CVE-2026-89789 is a use-after-free vulnerability in the Linux kernel's GPRS Tunnelling Protocol (GTP) module. The flaw resides in the gtp_newlink() error path, which frees the tid_hash and addr_hash structures without waiting for a Read-Copy-Update (RCU) grace period after clearing sk_user_data. A concurrent gtp_encap_recv() handler running in softirq context can still dereference the gtp_dev pointer obtained through rcu_dereference_sk_user_data(), resulting in access to freed memory. The condition was confirmed by KASAN, which reported a slab-use-after-free in gtp0_pdp_find().

Critical Impact
A local attacker with the ability to create GTP network devices can trigger memory corruption in the kernel, enabling privilege escalation or denial of service.

Affected Products

Linux kernel versions containing the vulnerable gtp_newlink() error path in drivers/net/gtp.c
Distributions shipping the GTP tunnel module prior to the referenced stable commits
Systems where the GTP kernel module (gtp.ko) is loaded and reachable by unprivileged network namespaces

Discovery Timeline

2026-09-16 - CVE-2026-89789 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89789

Vulnerability Analysis

The GTP driver maintains two hash tables, tid_hash and addr_hash, that index PDP contexts for tunnel lookups. During device creation, gtp_newlink() allocates these tables and attaches the gtp_dev structure to a UDP socket via sk_user_data. When an error occurs later in the setup path, the cleanup routine at out_hashtable clears sk_user_data and immediately frees the hash tables.

The problem stems from the interaction with the receive path. gtp_encap_recv() executes in softirq context when a UDP packet arrives on the GTP socket. It retrieves the gtp_dev pointer through rcu_dereference_sk_user_data() and then calls gtp0_pdp_find(), which walks the hash tables. Because the error path does not call synchronize_net() between clearing sk_user_data and freeing the tables, a receiver already inside the critical section can dereference freed memory.

Root Cause

The root cause is a missing RCU grace period between publisher-side pointer invalidation and memory reclamation. Readers accessing sk_user_data under RCU protection require the writer to wait for pending readers to complete before deallocating shared objects. The fix adds synchronize_net() before the kfree() calls in out_hashtable, ensuring all concurrent softirq handlers finish before the hash tables are released.

Attack Vector

Exploitation requires local access and the CAP_NET_ADMIN capability within a user or network namespace to create GTP tunnel devices. An attacker races repeated failing gtp_newlink() invocations against inbound UDP traffic destined for the GTP socket, forcing gtp_encap_recv() to dereference the freed hash tables. Successful exploitation can corrupt kernel memory, leading to privilege escalation or a kernel panic.

No public proof-of-concept exploit is currently available for CVE-2026-89789. See the upstream fix references for technical details on the vulnerable code path.

Detection Methods for CVE-2026-89789

Indicators of Compromise

KASAN reports containing slab-use-after-free in gtp0_pdp_find in kernel logs
Unexpected kernel oops or panic traces originating from gtp_encap_recv+0x527 or udp_queue_rcv_one_skb
Repeated failed RTM_NEWLINK netlink operations targeting the gtp link type from unprivileged workloads

Detection Strategies

Enable KASAN on test and staging kernels to surface use-after-free conditions in the GTP path
Monitor dmesg and journal output for stack traces referencing gtp0_pdp_find, gtp_newlink, or gtp_encap_recv
Audit which namespaces or containers hold CAP_NET_ADMIN and can therefore load or configure GTP devices

Monitoring Recommendations

Alert on kernel crash telemetry from workloads that do not legitimately use GTP tunneling
Track loading events for the gtp kernel module through auditd rules on init_module and finit_module
Correlate netlink link-creation failures with subsequent kernel warnings on the same host

How to Mitigate CVE-2026-89789

Immediate Actions Required

Apply the upstream stable kernel updates referenced in the commit list below as soon as your distribution publishes them
Unload the gtp module on systems that do not require GPRS tunneling using modprobe -r gtp
Restrict CAP_NET_ADMIN in unprivileged user namespaces where GTP functionality is not needed

Patch Information

The fix adds synchronize_net() before the kfree() calls in the out_hashtable label of gtp_newlink(), covering all error paths from both gtp_encap_enable() and gtp_create_sockets(). The patch is available in the following mainline and stable commits: Kernel Commit 3ca3da5, Kernel Commit 6f815c2, Kernel Commit 7677eb2, Kernel Commit 8d85498, Kernel Commit d989e22, Kernel Commit e3b9aa0, Kernel Commit fcafb2b, and Kernel Commit fd8396c.

Workarounds

Blacklist the gtp module through /etc/modprobe.d/ on hosts that do not require GPRS tunneling
Disable unprivileged user namespaces where feasible using sysctl -w kernel.unprivileged_userns_clone=0
Enforce seccomp or LSM policies that deny netlink RTM_NEWLINK calls creating GTP link types from untrusted workloads

bash

# Configuration example: prevent the vulnerable module from loading
echo 'blacklist gtp' | sudo tee /etc/modprobe.d/blacklist-gtp.conf
echo 'install gtp /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-gtp.conf
sudo modprobe -r gtp 2>/dev/null || true
sudo update-initramfs -u