CVE-2026-64577: gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
In the Linux kernel, the following vulnerability has been resolved:
gtp: check skbpulldata() return in gtp1usendechoresp()
gtp1usendechoresp() ignores skbpulldata()'s return value. Its caller gtp1uudpencaprecv() only guarantees 16 bytes (udphdr + gtp1header), but the pull requests 20 (gtp1headerlong + udphdr). For a 16-19 byte echo request the pull fails and returns NULL without advancing skb->data; execution continues, and the following skbpush() plus the IP header pushed by iptunnelxmit() move skb->data below skb->head, tripping skbunderpanic().
Fix it by dropping the packet when skbpulldata() fails.
skbuff: skbunderpanic: ... kernel BUG at net/core/skbuff.c:214! Call Trace: skbpush (net/core/skbuff.c:2648) iptunnelxmit (net/ipv4/iptunnelcore.c:82) gtpencaprecv (drivers/net/gtp.c:701 drivers/net/gtp.c:808 drivers/net/gtp.c:920) udpqueuercvoneskb (net/ipv4/udp.c:2388) ... Kernel panic - not syncing: Fatal exception in interrupt
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In gtp1u_send_echo_resp(), check the return value of skb_pull_data() and drop the packet when skb_pull_data() fails (i.e., if it returns NULL / does not advance skb->data).
Linux kernel gtp (gtp1u_send_echo_resp / skb_pull_data) skb_pull_data() return value check = required
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64577?
The severity of CVE-2026-64577 is rated at 57.
What does CVE-2026-64577 affect?
CVE-2026-64577 affects the Linux kernel, specifically the gtp1u_send_echo_resp() function.
How do I fix CVE-2026-64577?
To fix CVE-2026-64577, you need to update to the latest version of the Linux kernel where the vulnerability has been patched.
What is the main issue described in CVE-2026-64577?
CVE-2026-64577 describes a problem where gtp1u_send_echo_resp() ignores the return value of skb_pull_data().
When was CVE-2026-64577 published?
CVE-2026-64577 was published on August 5, 2026.