{"id":"CVE-2026-98849","kind":"vulnerability","aliases":["CVE-2026-98849"],"related":[],"title":"Linux kernel: PFCP driver double-frees its UDP socket on failed registration","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npfcp: fix socket lifetime on netdevice registration failure\n\npfcp_newlink() creates the UDP socket before register_netdevice().\nIf registration fails after pfcp_dev_init() succeeds, the core calls\npfcp_dev_uninit(), which releases the socket and clears pfcp->sk.\nThe newlink error path then releases it again, causing a NULL pointer\ndereference. This was observed with failslab fault injection:\n\n  FAULT_INJECTION: forcing a failure.\n  kobject: kobject_add_internal failed for pfcp0 (error: -12 parent: net)\n  BUG: KASAN: null-ptr-deref in udp_tunnel_sock_release+0x1c/0x50\n  Read of size 8 at addr 0000000000000120 by task ip/1037\n  Call trace:\n   show_stack+0x18/0x24 (C)\n   dump_stack_lvl+0x78/0x90\n   print_report+0x468/0x5cc\n   kasan_report+0xa4/0xf0\n   __asan_load8+0x7c/0xd0\n   udp_tunnel_sock_release+0x1c/0x50\n   pfcp_newlink+0x128/0x184\n   rtnl_newlink+0x848/0xe44\n   rtnetlink_rcv_msg+0x468/0x514\n   netlink_rcv_skb+0xc0/0x1f0\n   rtnetlink_rcv+0x18/0x24\n   netlink_unicast+0x4b8/0x558\n   netlink_sendmsg+0x2b8/0x584\n   ...\n\nReturn from pfcp_del_sock() if pfcp->sk is NULL.","summary":"When creating a pfcp network device fails during registration, the kernel releases the same UDP socket twice, causing a NULL pointer dereference. The sources describe a crash triggered during device creation, and do not describe code execution.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","runtime","self-hosted"],"not_affected_if":["pfcp-module-not-loaded"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it with the fixed kernel named in the advisory.\n- Check whether the pfcp module is loaded or available with `lsmod | grep pfcp` or `modinfo pfcp`.","fix":"- Update the Linux kernel to a release that includes the upstream fix for pfcp socket lifetime (the sources do not name a fixed version).","status":"open","published_at":"2026-10-18T16:17:39+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:04+00:00","updated_at":"2026-10-25T05:13:04+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:13:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for pfcp socket lifetime (the sources do not name a fixed version).","reach":"local","title":"Linux kernel: PFCP driver double-frees its UDP socket on failed registration","impact":"medium","summary":"When creating a pfcp network device fails during registration, the kernel releases the same UDP socket twice, causing a NULL pointer dereference. The sources describe a crash triggered during device creation, and do not describe code execution.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"local user crashes kernel via NULL pointer dereference during device creation","analyst_note":"Find the affected and fixed kernel version ranges in the NVD entry or the upstream stable commit for the pfcp socket lifetime fix.","how_to_check":"- Check the running kernel version with `uname -r` and compare it with the fixed kernel named in the advisory.\n- Check whether the pfcp module is loaded or available with `lsmod | grep pfcp` or `modinfo pfcp`.","needs_analyst":true,"not_affected_if":["pfcp-module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the pfcp driver (PFCP tunnelling, used with 5G user-plane setups) where a device is created by a user with the ability to run netlink link creation. Hosts that do not load the pfcp module can skip it. The sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000667,"input_tokens":3794,"output_tokens":576,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':159C,175C,181C,185C,189C,193C,199C,203C,207C,212C,217C,221C,225C,229C '-12':145C '-2026':15A,18A '-98849':16A,19A '0000000000000120':167C '8':164C 'add':139C 'addr':166C 'asan':191C 'bug':148C 'c':177C 'call':100C,171C 'caus':43B,120C 'clear':109C 'code':61B 'core':99C 'crash':52B 'creat':27B,83C 'creation':56B 'cve':14A,17A 'del':234C 'deref':153C 'derefer':47B,124C 'describ':50B,60B 'dev':95C,102C 'devic':31B,55B 'doubl':6A 'double-fre':5A 'driver':4A 'dump':178C 'error':114C,144C 'execut':62B 'fail':12A,32B,92C,141C 'failslab':129C 'failur':80C,136C 'fault':130C,132C 'fix':74C 'follow':68C 'forc':134C 'free':7A 'host':25B 'init':96C 'inject':131C,133C 'intern':140C 'ip/1037':170C 'kasan':149C,187C 'kernel':2A,20B,36B,66C 'kobject':137C,138C 'lifetim':76C 'linux':1A,21B,65C 'load8':192C 'lvl':180C 'msg':211C 'net':147C 'netdevic':78C,89C 'netlink':214C,223C,227C 'network':30B 'newlink':82C,113C,202C,206C 'null':45B,122C,151C,240C 'null-ptr-deref':150C 'observ':127C 'parent':146C 'path':115C 'pfcp':3A,29B,73C,81C,94C,101C,110C,201C,233C,237C 'pfcp0':143C 'pointer':46B,123C 'print':183C 'ptr':152C 'rcv':210C,215C,220C 'read':161C 'regist':88C 'registr':13A,34B,79C,91C 'releas':37B,105C,117C,158C,198C 'report':184C,188C 'resolv':72C 'return':231C 'rtnetlink':209C,219C 'rtnl':205C 'runtim':22B 'self':24B 'self-host':23B 'sendmsg':228C 'show':173C 'size':163C 'sk':111C,238C 'skb':216C 'sock':157C,197C,235C 'socket':10A,41B,75C,86C,107C 'sourc':49B 'stack':174C,179C 'succeed':97C 'task':169C 'trace':172C 'trigger':53B 'tunnel':156C,196C 'twice':42B 'udp':9A,40B,85C,155C,195C 'unicast':224C 'uninit':103C 'vulner':69C 'x128/0x184':204C 'x18/0x24':176C,222C 'x1c/0x50':160C,200C 'x2b8/0x584':230C 'x468/0x514':213C 'x468/0x5cc':186C 'x4b8/0x558':226C 'x78/0x90':182C 'x7c/0xd0':194C 'x848/0xe44':208C 'xa4/0xf0':190C 'xc0/0x1f0':218C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the pfcp driver (PFCP tunnelling, used with 5G user-plane setups) where a device is created by a user with the ability to run netlink link creation. Hosts that do not load the pfcp module can skip it. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98849","severity":null,"published_at":"2026-10-18T16:17:39+00:00","modified_at":"2026-10-19T10:19:49+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}