CVE-2026-89789

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the GPRS Tunneling Protocol (GTP) implementation. The gtp newlink() function error path frees tid hash and addr hash without waiting for a Read-Copy-Update (RCU) grace period after clearing sk user data. This allows a concurrent gtp encap recv() execution in softirq to access freed memory using a gtp dev pointer obtained via rcu dereference sk user data(). The issue was identified in the gtp0 pdp find() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.