CVE-2026-89789

CVE-2026-89789 is a use-after-free in the Linux kernel's GTP (GPRS Tunnelling Protocol) driver. When gtp_newlink() fails partway through setup (after gtp_encap_enable() or gtp_create_sockets()), its error path clears sk_user_data and immediately frees the tid_hash and addr_hash tables without waiting for an RCU grace period, so a concurrently running gtp_encap_recv() in softirq can still dereference a stale gtp_dev pointer and touch freed memory, as shown by the reported KASAN slab-use-after-free in gtp0_pdp_find(). Exploitation requires local access with the ability to create network links (CAP_NET_ADMIN-level privileges) plus an incoming GTP-over-UDP packet arriving on the socket at the right moment, and the resulting kernel UAF could yield memory corruption, crashes, or potentially local privilege escalation (CVSS 7.8). Only systems running kernels with the GTP module enabled and actively used for GTP tunnel endpoints (typical of mobile-core/EPC or telecom lab deployments) are affected. No public proof-of-concept and no confirmed exploitation have been reported.

What to do: Upgrade to a kernel release or stable branch that includes the fix adding synchronize_net() before the kfree calls in gtp_newlink()'s out_hashtable error path (no fixed version number is given in the advisory). If GTP tunnels are not needed, blacklist/unload the gtp module, and restrict untrusted local users' ability to create network links (CAP_NET_ADMIN) on multi-tenant hosts.