UBUNTU-CVE-2026-98849: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcpnewlink() creates the UDP socket before registernetdevice(). If registration fails after pfcpdevinit() succeeds, the core calls pfcpdevuninit(), which releases the socket and clears pfcp->sk. The newlink error path then releases it again, causing a NULL pointer dereference. This was observed with failslab fault injection: FAULTINJECTION: forcing a failure. kobject: kobjectaddinternal failed for pfcp0 (error: -12 parent: net) BUG: KASAN: null-ptr-deref in udptunnelsockrelease+0x1c/0x50 Read of size 8 at addr 0000000000000120 by task ip/1037 Call trace: showstack+0x18/0x24 (C) dumpstacklvl+0x78/0x90 printreport+0x468/0x5cc kasanreport+0xa4/0xf0 asanload8+0x7c/0xd0 udptunnelsockrelease+0x1c/0x50 pfcpnewlink+0x128/0x184 rtnlnewlink+0x848/0xe44 rtnetlinkrcvmsg+0x468/0x514 netlinkrcvskb+0xc0/0x1f0 rtnetlinkrcv+0x18/0x24 netlinkunicast+0x4b8/0x558 netlinksendmsg+0x2b8/0x584 ... Return from pfcpdelsock() if pfcp->sk is NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1019.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1~24.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-43.43 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1020.21 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1019.19 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1017.19 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1 - Compensating control
Modify pfcp_del_sock() to return immediately when pfcp->sk is NULL, preventing the newlink error path from releasing the socket a second time.
Event History
Frequently Asked Questions
Which systems are exposed?
The affected software list includes Ubuntu linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0. Exposure occurs in the PFCP netdevice creation path when netdevice registration fails after PFCP device initialization.
What access is required to trigger the issue?
The supplied severity vector identifies the attack vector as local and indicates low privileges are required. It also indicates an additional attack precondition is present.
How can an administrator recognize the failure?
The reported failure involves a failed PFCP netdevice registration, such as a kobject_add_internal failure for pfcp0, followed by a KASAN null-pointer dereference in udp_tunnel_sock_release through pfcp_newlink. The failure can result in a kernel BUG during the error-handling path.