In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcp_newlink()… (CVE-2026-98849)

The vulnerability in the Linux kernel pfcp subsystem arises from the pfcp_newlink() function creating a UDP socket before calling register_netdevice(). If the netdevice registration fails after pfcp_dev_init() has succeeded, the core calls pfcp_dev_uninit() which releases the socket and clears the pfcp->sk pointer. Subsequently, the newlink error path attempts to release the socket again, causing a NULL pointer dereference. This was confirmed via fault injection testing that forced a failure in kobject_add_internal, triggering a kernel address sanitizer (KASAN) null pointer dereference in udp_tunnel_sock_release(). The fix involves returning early from pfcp_del_sock() if pfcp->sk is NULL to prevent double release.

The vulnerability causes a kernel NULL pointer dereference leading to a potential denial of service (system crash) when netdevice registration fails in the pfcp subsystem. There is no indication of privilege escalation or arbitrary code execution from the provided data.

A fix has been implemented in the Linux kernel to address this issue by preventing double release of the socket resource. Users should apply the official kernel update that includes this fix. Since this is a kernel-level issue, updating to the patched kernel version is the recommended remediation.