Unchecked Return Value in Linux kernel - CVE-2026-64577
Published: August 6, 2026
Vulnerability identifier: #VU141031
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64577
CWE-ID: CWE-252
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of a failed buffer pull in gtp1u_send_echo_resp() in the Linux kernel GTP implementation when processing a crafted short echo request packet. A remote attacker can send a specially crafted packet to cause a kernel panic.
The issue is triggered by a 16 to 19 byte echo request that causes skb_pull_data() to fail while execution continues and skb data is moved below the buffer head.
Affected software
Linux kernel
How to mitigate CVE-2026-64577
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/4fc7923871d176ce0e5fecf4a9b7bb915af790ed
- https://git.kernel.org/stable/c/961e9b1e33445f8e42859ecc020c9f60d8b69a8b
- https://git.kernel.org/stable/c/b3c733eaae7f362601c28ac1533d47a961cd3e1c
- https://git.kernel.org/stable/c/cd170f051dba9ac146fabcd1b91726487c0cb9fa
- https://git.kernel.org/stable/c/cf45d748e437b8dd2dd987f27ee79c8c86f95c88