CVE-2026-98849

In the Linux kernel, the following vulnerability has been resolved:

pfcp: fix socket lifetime on netdevice registration failure

pfcp newlink() creates the UDP socket before register netdevice(). If registration fails after pfcp dev init() succeeds, the core calls pfcp dev uninit(), which releases the socket and clears pfcp->sk. The newlink error path then releases it again, causing a NULL pointer dereference. This was observed with failslab fault injection:

FAULT INJECTION: forcing a failure. kobject: kobject add internal failed for pfcp0 (error: -12 parent: net) BUG: KASAN: null-ptr-deref in udp tunnel sock release+0x1c/0x50 Read of size 8 at addr 0000000000000120 by task ip/1037 Call trace: show stack+0x18/0x24 (C) dump stack lvl+0x78/0x90 print report+0x468/0x5cc kasan report+0xa4/0xf0 asan load8+0x7c/0xd0 udp tunnel sock release+0x1c/0x50 pfcp newlink+0x128/0x184 rtnl newlink+0x848/0xe44 rtnetlink rcv msg+0x468/0x514 netlink rcv skb+0xc0/0x1f0 rtnetlink rcv+0x18/0x24 netlink unicast+0x4b8/0x558 netlink sendmsg+0x2b8/0x584 ...

Return from pfcp del sock() if pfcp->sk is NULL.