# CVE-2026-98849: pfcp: fix socket lifetime on netdevice registration failure

CVE-2026-98849 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-98849, released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-98849
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 18, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98849

## Description

In the Linux kernel, the following vulnerability has been resolved:  pfcp: fix socket lifetime on netdevice registration failure  pfcp_newlink() creates the UDP socket before register_netdevice(). If registration fails after pfcp_dev_init() succeeds, the core calls pfcp_dev_uninit(), which releases the socket and clears pfcp->sk. The newlink error path then releases it again, causing a NULL pointer dereference. This was observed with failslab fault injection:    FAULT_INJECTION: forcing a failure.   kobject: kobject_add_internal failed for pfcp0 (error: -12 parent: net)   BUG: KASAN: null-ptr-deref in udp_tunnel_sock_release+0x1c/0x50   Read of size 8 at addr 0000000000000120 by task ip/1037   Call trace:    show_stack+0x18/0x24 (C)    dump_stack_lvl+0x78/0x90    print_report+0x468/0x5cc    kasan_report+0xa4/0xf0    __asan_load8+0x7c/0xd0    udp_tunnel_sock_release+0x1c/0x50    pfcp_newlink+0x128/0x184    rtnl_newlink+0x848/0xe44    rtnetlink_rcv_msg+0x468/0x514    netlink_rcv_skb+0xc0/0x1f0    rtnetlink_rcv+0x18/0x24    netlink_unicast+0x4b8/0x558    netlink_sendmsg+0x2b8/0x584    ...  Return from pfcp_del_sock() if pfcp->sk is NULL.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.113-1 | [DEBIAN-CVE-2026-98849](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98849.md) | Oct 19, 2026 |
| Linux | linux Debian 14 | 7.2.10-1 | [DEBIAN-CVE-2026-98849](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98849.md) | Oct 19, 2026 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.113-1~deb12u1 | [DEBIAN-CVE-2026-98849](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98849.md) | Oct 19, 2026 |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.