CVE-2026-1682
📋 TL;DR
A null pointer dereference vulnerability in Free5GC SMF's PFCP UDP endpoint allows remote attackers to cause denial of service by sending specially crafted PFCP Association Release Request messages. This affects Free5GC deployments using SMF versions up to 4.1.0. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Free5GC SMF
📦 What is this software?
Free5gc by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Complete SMF service crash leading to loss of 5G core network session management functionality, disrupting mobile data services for affected subscribers.
Likely Case
SMF process termination requiring manual restart, causing temporary service interruption for new session establishment.
If Mitigated
Minimal impact with proper segmentation and monitoring; service automatically restarts with session recovery mechanisms.
🎯 Exploit Status
Exploit details published in GitHub issues; simple UDP packet manipulation required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 4.1.0
Vendor Advisory: https://github.com/free5gc/free5gc/issues/794
Restart Required: Yes
Instructions:
1. Update Free5GC SMF to latest version. 2. Apply patch from GitHub PR #188. 3. Restart SMF service.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict PFCP UDP endpoint access to trusted N4 interface peers only
iptables -A INPUT -p udp --dport 8805 -s <trusted_peer> -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
🧯 If You Can't Patch
- Implement strict network ACLs to limit PFCP UDP traffic to authorized UPF nodes only
- Deploy SMF behind stateful firewall with UDP flood protection and anomaly detection
🔍 How to Verify
Check if Vulnerable:
Check SMF version: free5gc-smf --version. If version ≤ 4.1.0, system is vulnerable.Check Version:
free5gc-smf --versionVerify Fix Applied:
Verify version > 4.1.0 and check that GitHub PR #188 changes are present in handler.go📡 Detection & Monitoring
Log Indicators:
- SMF process crashes/restarts
- PFCP Association Release Request errors
- Null pointer exceptions in SMF logs
Network Indicators:
- UDP packets to port 8805 with malformed PFCP headers
- Unusual PFCP Association Release Request frequency
SIEM Query:
source="smf.log" AND ("panic" OR "null pointer" OR "association release")🔗 References
- https://github.com/free5gc/free5gc/issues/794
- https://github.com/free5gc/free5gc/issues/794#issue-3811888505
- https://github.com/free5gc/free5gc/issues/794#issuecomment-3761063382
- https://github.com/free5gc/smf/
- https://github.com/free5gc/smf/pull/188
- https://vuldb.com/?ctiid.343475
- https://vuldb.com/?id.343475
- https://vuldb.com/?submit.739508
