CVE-2026-98849: pfcp: fix socket lifetime on netdevice registration failure
In the Linux kernel, the following vulnerability has been resolved:
pfcp: fix socket lifetime on netdevice registration failure
pfcpnewlink() creates the UDP socket before registernetdevice(). If registration fails after pfcpdevinit() succeeds, the core calls pfcpdevuninit(), which releases the socket and clears pfcp->sk. The newlink error path then releases it again, causing a NULL pointer dereference. This was observed with failslab fault injection:
FAULTINJECTION: forcing a failure. kobject: kobjectaddinternal failed for pfcp0 (error: -12 parent: net) BUG: KASAN: null-ptr-deref in udptunnelsockrelease+0x1c/0x50 Read of size 8 at addr 0000000000000120 by task ip/1037 Call trace: showstack+0x18/0x24 (C) dumpstacklvl+0x78/0x90 printreport+0x468/0x5cc kasanreport+0xa4/0xf0 asanload8+0x7c/0xd0 udptunnelsockrelease+0x1c/0x50 pfcpnewlink+0x128/0x184 rtnlnewlink+0x848/0xe44 rtnetlinkrcvmsg+0x468/0x514 netlinkrcvskb+0xc0/0x1f0 rtnetlinkrcv+0x18/0x24 netlinkunicast+0x4b8/0x558 netlinksendmsg+0x2b8/0x584 ...
Return from pfcpdelsock() if pfcp->sk is NULL.
Affected Software
Event History
Frequently Asked Questions
What conditions trigger the fault?
The fault requires PFCP netdevice creation to reach pfcp_dev_init() successfully and then have register_netdevice() fail. The cleanup path releases the UDP socket and clears pfcp->sk, after which the newlink error path attempts to release the same socket again.
What symptom indicates that this issue has been encountered?
The reported symptom is a KASAN null-pointer dereference in udp_tunnel_sock_release, reached from pfcp_newlink() during rtnetlink netdevice creation. The issue was observed when fault injection forced kobject_add_internal to fail while creating pfcp0.
What does the fix need to prevent?
The corrected cleanup behavior returns from pfcp_del_sock() when pfcp->sk is NULL. This prevents a second socket-release attempt after device uninitialization has already released the socket.