CVE-2026-80851: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-wq34-548c-54v3
Share
Published
Advisory Summary

CVE-2026-80851 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-80851 at a Glance

CVE Identifier CVE-2026-80851
GHSA Identifier GHSA-wq34-548c-54v3
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-80851

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-80851, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: gtp: serialize PDP context updates PDP contexts can be deleted through GTP_CMD_DELPDP or while the GTP network device is being unregistered. The latter is serialized by RTNL, but the generic-netlink delete path only holds RCU. Running both paths concurrently can therefore make both paths delete the same PDP context. The issue was found through static analysis and reproduced on a KASAN-enabled kernel by a simple two-thread program racing GTP_CMD_DELPDP against RTM_DELLINK: Oops: general protection fault, probably for non-canonical address KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127] RIP: gtp_genl_del_pdp+0x1c1/0x420 [gtp] RBP: dead000000000122 The second deletion dereferenced the poisoned hlist pprev pointer. Serialize gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink() with a shared mutex. Keep the mutex held until the final use of a PDP context in the NEWPDP path, and keep the RCU read-side section around the complete PDP context use in the DELPDP path.

References

NVD — CVE-2026-80851 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80851
git.kernel.org/stable/c/1e995498d2... WEB
https://git.kernel.org/stable/c/1e995498d29784a06a2b2899370a1926cfc8410d
git.kernel.org/stable/c/3d950e98f7... WEB
https://git.kernel.org/stable/c/3d950e98f74af9611925a5226edced02155f6ed1
git.kernel.org/stable/c/498386b6d4... WEB
https://git.kernel.org/stable/c/498386b6d402737db1e2eeed4c385acbf0ef9e34
git.kernel.org/stable/c/5f77ddb275... WEB
https://git.kernel.org/stable/c/5f77ddb2756340c1b05381674ca025d52998005e
git.kernel.org/stable/c/6df4f05bc2... WEB
https://git.kernel.org/stable/c/6df4f05bc2991467939d7d80b6f7e121559cc3df
git.kernel.org/stable/c/b4ac2a5ce5... WEB
https://git.kernel.org/stable/c/b4ac2a5ce5a96ec21ed48f60d30b52b1fb22c62a

Frequently Asked Questions

What is CVE-2026-80851?
CVE-2026-80851 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-80851?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-80851?
CVE-2026-80851 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-80851?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wq34-548c-54v3",
  "modified" : "2026-10-03T12:31:04Z",
  "published" : "2026-09-04T18:31:29Z",
  "aliases" : [ "CVE-2026-80851" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\ngtp: serialize PDP context updates\n\nPDP contexts can be deleted through GTP_CMD_DELPDP or while the GTP\nnetwork device is being unregistered. The latter is serialized by RTNL,\nbut the generic-netlink delete path only holds RCU.\n\nRunning both paths concurrently can therefore make both paths delete the\nsame PDP context. The issue was found through static analysis and\nreproduced on a KASAN-enabled kernel by a simple two-thread program\nracing GTP_CMD_DELPDP against RTM_DELLINK:\n\n  Oops: general protection fault, probably for non-canonical address\n  KASAN: maybe wild-memory-access in range\n         [0xdead000000000120-0xdead000000000127]\n  RIP: gtp_genl_del_pdp+0x1c1/0x420 [gtp]\n  RBP: dead000000000122\n\nThe second deletion dereferenced the poisoned hlist pprev pointer.\n\nSerialize gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink() with a\nshared mutex. Keep the mutex held until the final use of a PDP context in\nthe NEWPDP path, and keep the RCU read-side section around the complete\nPDP context use in the DELPDP path.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-80851"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1e995498d29784a06a2b2899370a1926cfc8410d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3d950e98f74af9611925a5226edced02155f6ed1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/498386b6d402737db1e2eeed4c385acbf0ef9e34"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5f77ddb2756340c1b05381674ca025d52998005e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6df4f05bc2991467939d7d80b6f7e121559cc3df"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b4ac2a5ce5a96ec21ed48f60d30b52b1fb22c62a"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-04T16:18:13Z"
  }
}