CVE-2026-64577

gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

State: Published
Severity: 7.5 High
Published: Aug 5, 2026
Updated: Aug 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

gtp1u_send_echo_resp() ignores skb_pull_data()'s return value. Its caller gtp1u_udp_encap_recv() only guarantees 16 bytes (udphdr + gtp1_header), but the pull requests 20 (gtp1_header_long + udphdr). For a 16-19 byte echo request the pull fails and returns NULL without advancing skb->data; execution continues, and the following skb_push() plus the IP header pushed by iptunnel_xmit() move skb->data below skb->head, tripping skb_under_panic().

Fix it by dropping the packet when skb_pull_data() fails.

skbuff: skb_under_panic: ... kernel BUG at net/core/skbuff.c:214! Call Trace: skb_push (net/core/skbuff.c:2648) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:82) gtp_encap_recv (drivers/net/gtp.c:701 drivers/net/gtp.c:808 drivers/net/gtp.c:920) udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) ... Kernel panic - not syncing: Fatal exception in interrupt

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	9af41cc33471ea1efa6f77e188f055cc77d0a5c5 to before 9033fe49926f0e7421fefee922dc086417e905cfAffected 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 to before b3c733eaae7f362601c28ac1533d47a961cd3e1cAffected 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 to before 4fc7923871d176ce0e5fecf4a9b7bb915af790edAffected 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 to before 961e9b1e33445f8e42859ecc020c9f60d8b69a8bAffected 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 to before cf45d748e437b8dd2dd987f27ee79c8c86f95c88Affected 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 to before cd170f051dba9ac146fabcd1b91726487c0cb9faAffected
LinuxLinux	5.18Affected before 5.18Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

9af41cc33471ea1efa6f77e188f055cc77d0a5c5 to before 9033fe49926f0e7421fefee922dc086417e905cfAffected
9af41cc33471ea1efa6f77e188f055cc77d0a5c5 to before b3c733eaae7f362601c28ac1533d47a961cd3e1cAffected
9af41cc33471ea1efa6f77e188f055cc77d0a5c5 to before 4fc7923871d176ce0e5fecf4a9b7bb915af790edAffected
9af41cc33471ea1efa6f77e188f055cc77d0a5c5 to before 961e9b1e33445f8e42859ecc020c9f60d8b69a8bAffected
9af41cc33471ea1efa6f77e188f055cc77d0a5c5 to before cf45d748e437b8dd2dd987f27ee79c8c86f95c88Affected
9af41cc33471ea1efa6f77e188f055cc77d0a5c5 to before cd170f051dba9ac146fabcd1b91726487c0cb9faAffected

LinuxLinux

5.18Affected
before 5.18Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.