CVE-2026-1975
📋 TL;DR
A null pointer dereference vulnerability in Free5GC's pfcp_reports.go allows remote attackers to cause denial of service by triggering the identityTriggerType function. This affects all Free5GC deployments up to version 4.1.0 that use the vulnerable component.
💻 Affected Systems
- Free5GC
📦 What is this software?
Free5gc by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the Free5GC core network function, potentially affecting all connected 5G devices and services.
Likely Case
Service instability or crashes of the affected Free5GC component, leading to partial 5G service disruption.
If Mitigated
Minimal impact with proper network segmentation and monitoring in place to detect and block exploitation attempts.
🎯 Exploit Status
Exploit details are publicly available in GitHub issues and pull requests. Remote exploitation without authentication is possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 4.1.0 or patched versions referenced in GitHub PR #189
Vendor Advisory: https://github.com/free5gc/free5gc/issues/814
Restart Required: Yes
Instructions:
1. Update Free5GC to a version that includes the fix from GitHub PR #189. 2. Apply the specific patch to pfcp_reports.go if using older versions. 3. Restart the Free5GC SMF service.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to Free5GC SMF component to trusted sources only
iptables -A INPUT -p tcp --dport [SMF_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [SMF_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to the vulnerable component
- Deploy monitoring and alerting for abnormal SMF process behavior or crashes
🔍 How to Verify
Check if Vulnerable:
Check Free5GC version and verify if pfcp_reports.go contains the vulnerable identityTriggerType function without null pointer checksCheck Version:
free5gc version | grep -i versionVerify Fix Applied:
Verify the patch from GitHub PR #189 is applied to pfcp_reports.go and check for proper null pointer handling📡 Detection & Monitoring
Log Indicators:
- SMF process crashes
- Null pointer exception logs in Free5GC logs
- Abnormal termination of pfcp_reports.go related processes
Network Indicators:
- Unexpected traffic patterns to SMF ports
- Multiple connection attempts triggering the vulnerable function
SIEM Query:
source="free5gc.logs" AND ("null pointer" OR "panic" OR "crash") AND process="smf"