Look up another CVE · open CVE-2026-64577 in the interactive tracker

CVE-2026-64577

gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

7.5 EPSS 0.6% AV:N

Published 2026-08-05 (2 months ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-64577 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	fixedDLA-4777-1 · 2026-09-08 · text	6.1.187-1	Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts.
Debian 13trixie	fixedDSA-6415-1 · 2026-08-06 · text	6.12.101-1	Update the kernel and reboot. DSA-6415-1 shipped the fix on 2026-08-06, in 6.12.101-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.1.6-1	Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.6-1	Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts.
Debian 12bookworm · linux-6.12	fixedDLA-4745-1 · 2026-08-18 · text	6.12.101-1~deb12u1	Update the kernel and reboot. DLA-4745-1 shipped the fix on 2026-08-18, in 6.12.101-1~deb12u1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

gtp1u_send_echo_resp() ignores skb_pull_data()'s return value. Its caller gtp1u_udp_encap_recv() only guarantees 16 bytes (udphdr + gtp1_header), but the pull requests 20 (gtp1_header_long + udphdr). For a 16-19 byte echo request the pull fails and returns NULL without advancing skb->data; execution continues, and the following skb_push() plus the IP header pushed by iptunnel_xmit() move skb->data below skb->head, tripping skb_under_panic(). Fix it by dropping the packet when skb_pull_data() fails. skbuff: skb_under_panic: ... kernel BUG at net/core/skbuff.c:214! Call Trace: skb_push (net/core/skbuff.c:2648) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:82) gtp_encap_recv (drivers/net/gtp.c:701 drivers/net/gtp.c:808 drivers/net/gtp.c:920) udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) ... Kernel panic - not syncing: Fatal exception in interrupt

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/net/gtp.c

What this is: GTP (GPRS Tunneling Protocol)MAINTAINERS section matched on drivers/net/gtp.c · osmocom-net-gprs@lists.osmocom.org · Maintained
Kernel module: gtp

Check it on the machine

grep -w CONFIG_GTP /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w gtp

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

bookworm, trixie, forky, sid, bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/cloud-arm64

M: a module where it is built at all; some flavours do not build it

Build switch: CONFIG_GTP

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-08-05 (2 months ago)source
CVSS: 7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsource recompute it
Attack vector: network (AV:N)source
EPSS: 0.58%, higher than 46.3% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: drivers/net

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
5.18	6.1.183	9033fe49926f
5.18	6.6.148	b3c733eaae7f
5.18	6.12.101	4fc7923871d1
5.18	6.18.42	961e9b1e3344
5.18	7.1.6	cf45d748e437
5.18	7.2	cd170f051dba

Debian advisories

Advisory	Date	Shipped to	Debian
DLA-4777-1	2026-09-08	bookworm 6.1.187-1	tracker
DLA-4745-1	2026-08-18	bookworm 6.12.101-1~deb12u1	tracker
DSA-6415-1	2026-08-06	trixie 6.12.101-1	tracker

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network: A crafted GTP-U Echo Request to UDP port 2152 reaches gtp_encap_recv → gtp1u_udp_encap_recv → gtp1u_send_echo_resp via the in-kernel UDP encap receive path, so a remote IP peer can trigger the bug without local access.
AC:LAttack complexity, low: The attacker fully controls the packet: a 16–19 byte GTP-U Echo Request with the S flag set and TEID 0 reliably fails the unchecked 20-byte pull and drives the subsequent skb_push path into skb_under_panic with no race or external condition required.
PR:NPrivileges required, none: GTP-U echo handling runs on unauthenticated received UDP datagrams once a GTP device with kernel-created sockets exists; the attacker needs no credentials or local privileges on the target.
UI:NUser interaction, none: No victim action is required; packet delivery to the GTP-U encap socket alone invokes the vulnerable echo-response path.
S:UScope, unchanged: Impact is a kernel BUG/panic in the host GTP/network stack within the same security authority; it does not cross a VM, IOMMU, or other separate boundary.
C:NConfidentiality impact, none: The failure is a deterministic skb headroom underflow caught by skb_under_panic/BUG with no out-of-bounds read, UAF, or other information-disclosure primitive identified.
I:NIntegrity impact, none: skb_push detects data < head and BUG()s before further attacker-controlled writes; this is an availability crash, not an exploitable write or control-flow hijack primitive.
A:HAvailability impact, high: The commit-reproduced path hits skb_under_panic and a fatal kernel BUG in interrupt context, causing kernel panic and full denial of service that can be retriggered by further crafted echo requests.