CVE-2026-64577

A flaw was found in the Linux kernel's GPRS Tunnelling Protocol (GTP) module. This vulnerability occurs because the gtp1u_send_echo_resp() function does not properly check the return value when processing certain echo requests. A remote attacker could send a specially crafted echo request, causing the kernel to panic and leading to a Denial of Service (DoS) on the system.

A denial of service flaw of moderate impact was found in the Linux kernel's GPRS Tunnelling Protocol (GTP) module. The gtp1u_send_echo_resp() function does not check the return value of skb_pull_data() when building an echo response. The receive path only guarantees 16 bytes (udphdr + gtp1_header), but the pull requests 20 bytes (gtp1_header_long + udphdr); for a 16-19 byte echo request the pull fails without advancing skb->data, and the subsequent skb_push() together with the IP header pushed by iptunnel_xmit() moves skb->data below skb->head, tripping skb_under_panic() and causing a kernel panic. A remote attacker with network reachability to a configured GTP UDP encapsulation endpoint could send a specially crafted GTPv1-U echo request to trigger this panic, resulting in a denial of service of the affected system. All shipped Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt packages are not affected by this flaw because the vulnerable code is not present in these builds. The CVE.org record scores this flaw 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), while Red Hat rates it moderate, since exploitation requires GTP support to be enabled and a GTP UDP encapsulation socket to be configured and reachable by the attacker.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.