CVE-2026-64577

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The gtp1u send echo resp() function fails to check the return value of skb pull data(). When processing an echo request between 16 and 19 bytes, the pull request for 20 bytes fails and returns NULL without advancing skb->data. Subsequent calls to skb push() and the IP header push by iptunnel xmit() move skb->data below skb->head, which triggers skb under panic() and results in a kernel panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.