CVE-2026-64577

In the Linux kernel, the following vulnerability has been resolved:

gtp: check skbpulldata() return in gtp1usendecho_resp()

gtp1usendechoresp() ignores skbpulldata()'s return value. Its caller gtp1uudpencaprecv() only guarantees 16 bytes (udphdr + gtp1header), but the pull requests 20 (gtp1headerlong + udphdr). For a 16-19 byte echo request the pull fails and returns NULL without advancing skb->data; execution continues, and the following skbpush() plus the IP header pushed by iptunnelxmit() move skb->data below skb->head, tripping skbunder_panic().

Fix it by dropping the packet when skbpulldata() fails.

skbuff: skbunderpanic: ... kernel BUG at net/core/skbuff.c:214! Call Trace: skbpush (net/core/skbuff.c:2648) iptunnelxmit (net/ipv4/iptunnelcore.c:82) gtpencaprecv (drivers/net/gtp.c:701 drivers/net/gtp.c:808 drivers/net/gtp.c:920) udpqueuercvoneskb (net/ipv4/udp.c:2388) ... Kernel panic - not syncing: Fatal exception in interrupt