CVE-2026-26024: free5GC SMF crash (nil pointer dereference) on PFCP SessionReportRequest when ReportType.USAR=1 and UsageReport omits mandatory URRID sub-IE 
free5GC SMF provides Session Management Function for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, SMF panics and terminates when processing a malformed PFCP SessionReportRequest on the PFCP (UDP/8805) interface. No known upstream fix is available, but some workarounds are available. ACL/firewall the PFCP interface so only trusted UPF IPs can reach SMF (reduce spoofing/abuse surface); drop/inspect malformed PFCP SessionReportRequest messages at the network edge where feasible, and/or add recover() around PFCP handler dispatch to avoid whole-process termination (mitigation only).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26024?
CVE-2026-26024 is classified as a medium severity vulnerability due to the potential for a crash in the free5GC SMF.
How do I fix CVE-2026-26024?
To fix CVE-2026-26024, upgrade free5GC SMF to version 1.4.2 or higher where the vulnerability is addressed.
What causes the CVE-2026-26024 vulnerability?
CVE-2026-26024 is caused by a nil pointer dereference in free5GC SMF when processing a PFCP SessionReportRequest with specific report configurations.
Which versions of free5GC SMF are affected by CVE-2026-26024?
Free5GC SMF versions up to and including 1.4.1 are affected by CVE-2026-26024.
What impact does CVE-2026-26024 have on users?
The impact of CVE-2026-26024 is that it may lead to a crash of the session management function, affecting the stability of the 5G mobile core network.