gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

...

SUSE CVE-2026-64577

In the Linux kernel, the following vulnerability has been resolved: gtp: check skbpulldata return in gtp1usendechoresp gtp1usendechoresp ignores skbpulldata's return value. Its caller gtp1uudpencaprecv only guarantees 16 bytes udphdr + gtp1header, but the pull requests 20 gtp1headerlong + udphdr...

CVE-2026-64577

In the Linux kernel, the following vulnerability has been resolved: gtp: check skbpulldata return in gtp1usendechoresp gtp1usendechoresp ignores skbpulldata's return value. Its caller gtp1uudpencaprecv only guarantees 16 bytes udphdr + gtp1header, but the pull requests 20 gtp1headerlong + udphdr...

CVE-2026-64577 gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

In the Linux kernel, the following vulnerability has been resolved: gtp: check skbpulldata return in gtp1usendechoresp gtp1usendechoresp ignores skbpulldata's return value. Its caller gtp1uudpencaprecv only guarantees 16 bytes udphdr + gtp1header, but the pull requests 20 gtp1headerlong + udphdr...

CVE-2026-64577

CVE-2026-64577 concerns the Linux kernel GTP module. The vulnerability arises because gtp1u_send_echo_resp() ignores the return value of skb_pull_data(); the function’s caller guarantees 16 bytes but the pull may require 20, so an echo request of 16–19 bytes can fail to advance skb->data. This...

CVE-2026-64577

In the Linux kernel, the following vulnerability has been resolved: gtp: check skbpulldata return in gtp1usendechoresp gtp1usendechoresp ignores skbpulldata's return value. Its caller gtp1uudpencaprecv only guarantees 16 bytes udphdr + gtp1header, but the pull requests 20 gtp1headerlong + udphdr...

EUVD-2026-53271

In the Linux kernel, the following vulnerability has been resolved: gtp: check skbpulldata return in gtp1usendechoresp gtp1usendechoresp ignores skbpulldata's return value. Its caller gtp1uudpencaprecv only guarantees 16 bytes udphdr + gtp1header, but the pull requests 20 gtp1headerlong + udphdr...

CVE-2026-64577 gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

In the Linux kernel, the following vulnerability has been resolved: gtp: check skbpulldata return in gtp1usendechoresp gtp1usendechoresp ignores skbpulldata's return value. Its caller gtp1uudpencaprecv only guarantees 16 bytes udphdr + gtp1header, but the pull requests 20 gtp1headerlong + udphdr...

Security update for the Linux Kernel (Live Patch 33 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise kernel 5.14.21-150500.55.130 fixes various security issues The following security issues were fixed: CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer bsc1255577. CVE-2023-54142: gtp: Fix use-after-free in gtpencapdestroy bsc1256097...

CVE-2026-2517

A security flaw has been discovered in Open5GS up to 2.7.6. This vulnerability affects the function ogsgtp2parsetft in the library lib/gtp/v2/types.c of the component SMF. Performing a manipulation of the argument pf0.content.length results in denial of service. The attack is possible to be carri...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to fix various security issues The following security issues were fixed: CVE-2022-50282: chardev: fix error handling in cdevdeviceadd bsc1249739. CVE-2022-50630: mm: hugetlb: fix UAF in hugetlbhandleuserfault bsc1254785. CVE-2022-50700: wifi:...

CVE-2023-54142 gtp: Fix use-after-free in __gtp_encap_destroy().

In the Linux kernel, the following vulnerability has been resolved: gtp: Fix use-after-free in gtpencapdestroy. syzkaller reported use-after-free in gtpencapdestroy. 0 It shows the same process freed sk and touched it illegally. Commit e198987e7dd7 "gtp: fix suspicious RCU usage" added locksock a...

CVE-2023-54142

CVE-2023-54142: In the Linux kernel gtp_encap path, a use-after-free occurs in __gtp_encap_destroy() when sk cleanup races with sock data access. The advisory notes that a previous patch added lock_sock() and release_sock() around __gtp_encap_destroy() to protect sk->sk_user_data, but release_...

OESA-2025-2122 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: gtp: Destroy device along with udp socket's netns dismantle. gtpnewlink links the device to a list in devnetdev instead of srcnet, where a udp tunnel socket is...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: gtp: The device is destroyed along with the udp socket’s netns. The gtpnewlink function links the device to the list in devnet dev, instead of srcnet, where an udp tunnel socket is created. Even when srcnet is removed, the...

DEBIAN-CVE-2025-21865

In the Linux kernel, the following vulnerability has been resolved: gtp: Suppress list corruption splat in gtpnetexitbatchrtnl. Brad Spengler reported the listdel corruption splat in gtpnetexitbatchrtnl. 0 Commit eb28fd76c0a0 "gtp: Destroy device along with udp socket's netns dismantle." added th...

SUSE CVE-2025-21678

In the Linux kernel, the following vulnerability has been resolved: gtp: Destroy device along with udp socket's netns dismantle. gtpnewlink links the device to a list in devnetdev instead of srcnet, where a udp tunnel socket is created. Even when srcnet is removed, the device stays alive on...

CLSA-2024-1727817133 Fix of 74 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-26752 - l2tp: pass correct message length to ip6appenddata CVE-url: https://ubuntu.com/security/CVE-2021-47188 - scsi: ufs: core: Improve SCSI abort handling CVE-url: https://ubuntu.com/security/CVE-2024-26677 - rxrpc: Fix delayed ACKs to not set the...

SUSE CVE-2024-46677

In the Linux kernel, the following vulnerability has been resolved: gtp: fix a potential NULL pointer dereference When sockfdlookup fails, gtpencapenablesocket returns a NULL pointer, but its callers only check for error pointers thus miss the NULL pointer case. Fix it by returning an error point...

SUSE CVE-2024-44999

In the Linux kernel, the following vulnerability has been resolved: gtp: pull network headers in gtpdevxmit syzbot/KMSAN reported use of uninit-value in getdevxmit 1 We must make sure the IPv4 or Ipv6 header is pulled in skb-head before accessing fields in them. Use pskbinetmaypull to fix this...