CVE-2026-89789 Affecting linux-6.12 package, versions <6.12.111-1~deb12u1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIAN12-LINUX612-20506606
- published5 Oct 2026
- disclosed16 Sept 2026
Introduced: 16 Sep 2026
NewCVE-2026-89789 (opens in a new tab)How to fix?
Upgrade Debian:12 linux-6.12 to version 6.12.111-1~deb12u1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream linux-6.12 package and not the linux-6.12 package as distributed by Debian.
See How to fix? for Debian:12 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
gtp_newlink()'s error path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing sk_user_data. A concurrent gtp_encap_recv() in softirq may still hold the gtp_dev pointer obtained via rcu_dereference_sk_user_data() and access the freed memory.
BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152) Call Trace: <IRQ> gtp0_pdp_find+0x1f6/0x200 gtp_encap_recv+0x527/0x24b0 udp_queue_rcv_one_skb+0x75f/0xc10
Add synchronize_net() before the kfree calls in out_hashtable, which covers all error paths from both gtp_encap_enable() and gtp_create_sockets().
References
- https://security-tracker.debian.org/tracker/CVE-2026-89789
- https://git.kernel.org/stable/c/3ca3da5c305caa873ddb81e8c6b118143f6dd3d1
- https://git.kernel.org/stable/c/6f815c2fb6ab20385f81c353cdad0ea3b88132af
- https://git.kernel.org/stable/c/7677eb2cbf2cc7446de474c01a6b06277c0051e5
- https://git.kernel.org/stable/c/8d85498016a5bb56339734a14c276209fa65bafc
- https://git.kernel.org/stable/c/d989e22ae9802c52c56ad4284d0caf26696cf6ae
- https://git.kernel.org/stable/c/e3b9aa0773abd5d4ed90be41ce5306c146d5b09e
- https://git.kernel.org/stable/c/fcafb2b1430824bae4258c01a439ec97ca0c6973
- https://git.kernel.org/stable/c/fd8396cfecbd904468c71362f08aaa25f96d5337