CVE-2026-89789 gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
A use-after-free in the Linux kernel GTP module allows attackers to cause denial of service or execute code via concurrent network processing.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89789?
CVE-2026-89789 is a high-severity use after free vulnerability in Linux, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
gtp_newlink()'s error path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing sk_user_data. A concurrent gtp_encap_recv() in softirq may still hold the gtp_dev pointer obtained via rcu_dereference_sk_user_data() and access the freed memory.
BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152) Call Trace: <IRQ> gtp0_pdp_find+0x1f6/0x200 gtp_encap_recv+0x527/0x24b0 udp_queue_rcv_one_skb+0x75f/0xc10
Add synchronize_net() before the kfree calls in out_hashtable, which covers all error paths from both gtp_encap_enable() and gtp_create_sockets().
Which versions are affected by CVE-2026-89789?
How do I fix CVE-2026-89789?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89789 being exploited?
There is no known exploitation of CVE-2026-89789 in the wild and no public exploit code.
Sources
Also known as AZL-101405, BELL-CVE-2026-89789, DEBIAN-CVE-2026-89789, GHSA-h6q8-7j67-4q68, UBUNTU-CVE-2026-89789.