CVE-2026-1976
📋 TL;DR
A null pointer dereference vulnerability in Free5GC's SMF component allows remote attackers to cause denial of service by exploiting the SessionDeletionResponse function. This affects Free5GC deployments up to version 4.1.0. The vulnerability is remotely exploitable and a public exploit exists.
💻 Affected Systems
- Free5GC
📦 What is this software?
Free5gc by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the SMF component, potentially affecting 5G core network functionality and causing service outages for connected devices.
Likely Case
Denial of service affecting the SMF component, leading to session management failures and degraded network performance.
If Mitigated
Limited impact with proper network segmentation and monitoring, potentially causing only isolated service interruptions.
🎯 Exploit Status
Exploit code is publicly available and the vulnerability requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.1 or later
Vendor Advisory: https://github.com/free5gc/free5gc/issues/817
Restart Required: Yes
Instructions:
1. Update Free5GC to version 4.1.1 or later. 2. Apply the patch from GitHub pull request #189. 3. Restart the SMF service.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to SMF component to trusted networks only
iptables -A INPUT -p tcp --dport <smf_port> -s <trusted_network> -j ACCEPT
iptables -A INPUT -p tcp --dport <smf_port> -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit SMF exposure
- Deploy intrusion detection/prevention systems to monitor for exploit attempts
🔍 How to Verify
Check if Vulnerable:
Check Free5GC version: if version <= 4.1.0, system is vulnerableCheck Version:
free5gc versionVerify Fix Applied:
Verify Free5GC version is 4.1.1 or later and check that GitHub pull request #189 changes are applied📡 Detection & Monitoring
Log Indicators:
- SMF service crashes
- Null pointer exception logs in SMF component
- Unusual session deletion requests
Network Indicators:
- Multiple malformed session deletion requests to SMF port
- Traffic patterns matching known exploit
SIEM Query:
source="free5gc" AND ("null pointer" OR "SessionDeletionResponse" OR "SMF crash")