CVE-2026-80851

What it actually does

Concurrent execution of PDP context deletion via generic netlink command and network device unregistration can cause two deletion paths to operate on the same context, resulting in a use-after-free dereference of a poisoned hlist pointer and kernel oops.

Why it matters to the business

Systems relying on the GTP kernel module for mobile data tunneling may experience unexpected kernel crashes or instability when PDP contexts are managed under concurrent delete operations, leading to service disruption in network infrastructure.

How an attack unfolds

An attacker with local access capable of issuing GTP netlink commands races a DELPDP deletion against an RTM_DELLINK operation on the GTP device; the lack of serialization allows both paths to free the same context, triggering the fault on the second dereference.

How to fix it

Apply the upstream kernel patch that introduces a shared mutex to serialize gtp_pdp_add, gtp_genl_del_pdp, and gtp_dellink operations, ensuring the mutex remains held for the lifetime of PDP context use in addition paths and RCU sections are maintained in deletion paths.

How to confirm the fix worked

Confirm the presence of the mutex serialization around the affected functions in the gtp module source; test by running concurrent DELPDP and RTM_DELLINK operations on a debug kernel with KASAN enabled and verify absence of wild-memory-access faults.

Typical attack path

1. Obtain local access or privileges sufficient to interact with GTP netlink interface and manage network devices.
2. Create a PDP context via NEWPDP.
3. Simultaneously issue DELPDP and trigger device unregistration (RTM_DELLINK) in separate threads.
4. Trigger the double-delete path that dereferences the freed context, causing kernel fault.

How to detect it

Inspect kernel logs for general protection faults or KASAN reports mentioning gtp_genl_del_pdp or deadbeef-style addresses during GTP device teardown; correlate with netlink activity involving GTP_CMD_DELPDP and RTM_DELLINK.

What your security team should do

• Prioritize patching Linux kernels that include the gtp module in network-facing or containerized environments.
• Monitor kernel oops and KASAN reports referencing gtp_genl_del_pdp for signs of attempted exploitation.
• Restrict unprivileged access to netlink and network device configuration interfaces where GTP is enabled.