CVE-2026-80851 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as system administrators responsible for managing Linux-based systems that utilize GTP, should assess their exposure to this vulnerability and prioritize patching or applying mitigations as necessary.

Why it matters

This vulnerability in the Linux kernel's GTP implementation can lead to a use-after-free condition, potentially causing denial-of-service or arbitrary code execution. Linux kernel developers, maintainers, and system administrators should assess exposure and prioritize patching or mitigations.

• Denial-of-service due to use-after-free condition
• Potential for arbitrary code execution if exploited
• Need for patching or applying mitigations to prevent exploitation
• Unclear scope of affected systems requires thorough inventory and assessment

Technical summary

The Linux kernel's GTP implementation is vulnerable to a use-after-free condition when deleting PDP contexts. This occurs because the generic-netlink delete path only holds RCU, while the network device unregistration path is serialized by RTNL. To address this issue, a shared mutex is introduced to serialize gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink() operations. The vulnerability can be triggered by a specially crafted sequence of GTP_CMD_DELPDP and RTM_DELLINK operations, potentially leading to denial-of-service or arbitrary code execution. Linux kernel developers, maintainers, and system administrators should assess exposure and prioritize patching or mitigations.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to ensure the GTP implementation is properly synchronized.
• Monitor system logs for suspicious GTP activity.
• Consider implementing additional access controls or restrictions on GTP usage.
• Perform a thorough inventory of Linux-based systems that utilize GTP to assess exposure.
• Prioritize patching or applying mitigations for affected systems.
• Track exceptions and retest remediated assets.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability was introduced in the Linux kernel's GTP implementation and can be triggered by a specially crafted sequence of GTP_CMD_DELPDP and RTM_DELLINK operations. The issue was found through static analysis and reproduced on a KASAN-enabled kernel.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.