CVE-2026-64577 Details
Description
In the Linux kernel, the following vulnerability has been resolved: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() gtp1u_send_echo_resp() ignores skb_pull_data()'s return value. Its caller gtp1u_udp_encap_recv() only guarantees 16 bytes (udphdr + gtp1_header), but the pull requests 20 (gtp1_header_long + udphdr). For a 16-19 byte echo request the pull fails and returns NULL without advancing skb->data; execution continues, and the following skb_push() plus the IP header pushed by iptunnel_xmit() move skb->data below skb->head, tripping skb_under_panic(). Fix it by dropping the packet when skb_pull_data() fails. skbuff: skb_under_panic: ... kernel BUG at net/core/skbuff.c:214! Call Trace: skb_push (net/core/skbuff.c:2648) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:82) gtp_encap_recv (drivers/net/gtp.c:701 drivers/net/gtp.c:808 drivers/net/gtp.c:920) udp_queue_rcv_one_skb (net/ipv4/udp.c:2388) ... Kernel panic - not syncing: Fatal exception in interrupt
A vulnerability exists in the Linux kernel's GTP (GPRS Tunneling Protocol) implementation, specifically in the handling of echo response messages. The issue arises in the function 'gtp1u_send_echo_resp()', which fails to properly check the return value of 'skb_pull_data()'. This oversight can lead to a kernel panic. The function's caller, 'gtp1u_udp_encap_recv()', only ensures 16 bytes are available (combining the UDP header and GTP header), but 'skb_pull_data()' requests 20 bytes. As a result, for echo requests ranging from 16 to 19 bytes, the pull operation fails, returning NULL without advancing the socket buffer's data pointer. Execution then continues, causing subsequent operations to move the data pointer below the buffer's head, triggering 'skb_under_panic()' and causing a kernel panic. The vulnerability has been addressed by modifying the code to drop packets when 'skb_pull_data()' fails.
The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version where this issue has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
No affected product data is available for this CVE.
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 19, 2026 | CVE Modified | kernel.org |
| Aug 17, 2026 | CVE Modified | kernel.org |
| Aug 8, 2026 | CVE Modified | kernel.org |
| Aug 5, 2026 | New CVE Received | kernel.org |