CVE-2026-94043: Free5GC Race Condition Vulnerability

CVE-2026-94043 Overview

CVE-2026-94043 is a race condition vulnerability in Free5GC, an open-source 5G core network implementation. The flaw affects versions up to 4.2.3 and resides in the Access and Mobility Management Function (AMF) component. Specifically, the vulnerable code exists in /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go, part of the GMM (5GS Mobility Management) Handler. Concurrent access to the RanUe map within the AmfUe context lacks proper synchronization, enabling remote attackers to trigger unsafe concurrent map operations. The issue is tracked under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization).

Critical Impact
Remote attackers can trigger a race condition in the AMF GMM Handler by sending concurrent signaling requests, potentially causing availability degradation of the 5G core network.

Affected Products

Free5GC versions up to and including 4.2.3
Free5GC AMF (Access and Mobility Management Function) component
Deployments using the GMM Handler in internal/gmm/handler.go

Discovery Timeline

2026-09-20 - CVE-2026-94043 published to NVD
2026-09-21 - Last updated in NVD database
Patch commit - e323b01464355781b8b8d5dd695e05cbc00a62f2 released via GitHub AMF Pull Request #238

Technical Details for CVE-2026-94043

Vulnerability Analysis

The vulnerability originates in Free5GC's AMF, which handles UE (User Equipment) registration, mobility, and session management in a 5G core network. The AmfUe structure maintains a RanUe map keyed by AccessType, tracking Radio Access Network user contexts across both 3GPP and non-3GPP access. Multiple goroutines in the GMM Handler access this map concurrently without mutex protection. Go's built-in map type is not safe for concurrent read/write operations. When two goroutines mutate or read the map simultaneously, the Go runtime detects the conflict and panics, terminating the process. An unauthenticated remote attacker can trigger this condition by orchestrating concurrent NAS signaling flows against the AMF, resulting in denial of service for the 5G core control plane.

Root Cause

The root cause is missing synchronization around the RanUe map[models.AccessType]*RanUe field in the AmfUe context structure. Direct map access from multiple concurrent request handlers violates Go's memory model for maps and creates a classic [CWE-362] race condition.

Attack Vector

Exploitation requires network reachability to the AMF's N1/N2 interfaces. An attacker capable of initiating concurrent UE-related signaling procedures such as parallel registration, deregistration, or access-type transitions can race the map access paths. No authentication is required at the vulnerable code path, and the attack does not require user interaction.

// Patch: internal/context/amf_ue.go - add RWMutex to protect RanUe map
	/* Pdu Sesseion context */
	SmContextList sync.Map // map[int32]*SmContext, pdu session id as key
	/* Related Context */
-	RanUe map[models.AccessType]*RanUe
+	ranUeMu sync.RWMutex
+	RanUe   map[models.AccessType]*RanUe
	/* other */
	onGoing                         map[models.AccessType]*OnGoing
	UeRadioCapability               string // OCTET string

Source: GitHub AMF Commit e323b01

// Patch: internal/gmm/common/user_profile.go - route access through GetRanUe accessor
func PurgeAmfUeSubscriberData(ue *context.AmfUe) {
-	if ue.RanUe[models.AccessType_3_GPP_ACCESS] != nil {
+	if ue.GetRanUe(models.AccessType_3_GPP_ACCESS) != nil {
 		err := PurgeSubscriberData(ue, models.AccessType_3_GPP_ACCESS)
 		if err != nil {
 			logger.GmmLog.Errorf("Purge subscriber data Error[%v]", err.Error())
 		}
 	}
-	if ue.RanUe[models.AccessType_NON_3_GPP_ACCESS] != nil {
+	if ue.GetRanUe(models.AccessType_NON_3_GPP_ACCESS) != nil {
 		err := PurgeSubscriberData(ue, models.AccessType_NON_3_GPP_ACCESS)

Source: GitHub AMF Commit e323b01

Detection Methods for CVE-2026-94043

Indicators of Compromise

Unexpected AMF process crashes or restarts accompanied by Go runtime panic messages referencing concurrent map read and map write or concurrent map iteration and map write.
Bursts of concurrent NAS registration or deregistration requests from a small set of source identifiers targeting the AMF.
Loss of UE context state or increased failure rates in mobility procedures shortly after abnormal traffic spikes.

Detection Strategies

Enable the Go race detector in non-production Free5GC builds to surface unsynchronized RanUe map access during load and fuzz testing.
Monitor AMF logs for runtime.throw stack traces originating from internal/gmm/handler.go or internal/context/amf_ue.go.
Correlate AMF process restarts with N1/N2 traffic volume and per-supi request concurrency to identify race-triggering traffic patterns.

Monitoring Recommendations

Track AMF service availability, restart counts, and control-plane latency using metrics exporters and alert on anomalous restart cadence.
Capture packet metadata on N1/N2 interfaces to detect abnormal parallelism in signaling procedures tied to individual subscribers.
Ingest AMF and 5G core telemetry into a centralized data lake for cross-component correlation and long-term forensic review.

How to Mitigate CVE-2026-94043

Immediate Actions Required

Upgrade Free5GC to a build that includes commit e323b01464355781b8b8d5dd695e05cbc00a62f2 from GitHub AMF Pull Request #238.
Audit any downstream forks or custom AMF deployments to ensure they incorporate the ranUeMu sync.RWMutex guard and use the GetRanUe accessor.
Restrict network exposure of the AMF's N1/N2 interfaces to trusted RAN elements and management networks only.

Patch Information

The fix introduces a sync.RWMutex (ranUeMu) protecting the RanUe map in internal/context/amf_ue.go and replaces direct map indexing with a GetRanUe accessor across GMM handlers. Apply the patch by updating to a Free5GC AMF release containing commit e323b01. Track upstream remediation status in free5gc Issue #1109 and the VulDB entry for CVE-2026-94043.

Workarounds

Rate-limit NAS signaling procedures per subscriber at ingress points to reduce the probability of concurrent handler invocations.
Deploy AMF instances behind a health-checked supervisor that restarts crashed processes and shifts traffic to healthy replicas.
Segment the 5G control plane so only authenticated gNBs can reach the AMF, minimizing untrusted concurrent request sources.

bash

# Build Free5GC AMF from a patched source tree
git clone https://github.com/free5gc/amf.git
cd amf
git checkout e323b01464355781b8b8d5dd695e05cbc00a62f2
go build -o bin/amf ./cmd/main.go

# Verify the patched context contains the RWMutex guard
grep -n "ranUeMu" internal/context/amf_ue.go