Linux Kernel PFCP: NULL-Pointer Deref on Netdevice Registration Failure
CVE-2026-98849 Published on October 18, 2026
pfcp: fix socket lifetime on netdevice registration failure
In the Linux kernel, the following vulnerability has been resolved:
pfcp: fix socket lifetime on netdevice registration failure
pfcp_newlink() creates the UDP socket before register_netdevice().
If registration fails after pfcp_dev_init() succeeds, the core calls
pfcp_dev_uninit(), which releases the socket and clears pfcp->sk.
The newlink error path then releases it again, causing a NULL pointer
dereference. This was observed with failslab fault injection:
FAULT_INJECTION: forcing a failure.
kobject: kobject_add_internal failed for pfcp0 (error: -12 parent: net)
BUG: KASAN: null-ptr-deref in udp_tunnel_sock_release+0x1c/0x50
Read of size 8 at addr 0000000000000120 by task ip/1037
Call trace:
show_stack+0x18/0x24 (C)
dump_stack_lvl+0x78/0x90
print_report+0x468/0x5cc
kasan_report+0xa4/0xf0
__asan_load8+0x7c/0xd0
udp_tunnel_sock_release+0x1c/0x50
pfcp_newlink+0x128/0x184
rtnl_newlink+0x848/0xe44
rtnetlink_rcv_msg+0x468/0x514
netlink_rcv_skb+0xc0/0x1f0
rtnetlink_rcv+0x18/0x24
netlink_unicast+0x4b8/0x558
netlink_sendmsg+0x2b8/0x584
...
Return from pfcp_del_sock() if pfcp->sk is NULL.
Products Associated with CVE-2026-98849
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 76c8764ef36a5d37ea2e551bda28ac7f028383ba and below dcb8f6a79c3360a440c399d85df465a6e59351f1 is affected.
- Version 76c8764ef36a5d37ea2e551bda28ac7f028383ba and below 4b8ce1686dea1a10805a0807bf492409b0300ee1 is affected.
- Version 76c8764ef36a5d37ea2e551bda28ac7f028383ba and below 2cee3603ec1d9b5ec7f2121ea3efe9488e906f46 is affected.
- Version 76c8764ef36a5d37ea2e551bda28ac7f028383ba and below 0f17d2e3dd9cda3ee6d94033d5e5489af168920d is affected.
- Version 6.10 is affected.
- Before 6.10 is unaffected.
- Version 6.12.113, <= 6.12.* is unaffected.
- Version 6.18.56, <= 6.18.* is unaffected.
- Version 7.2.10, <= 7.2.* is unaffected.
- Version 7.3-rc6, <= * is unaffected.