CVE-2026-44328: free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating

Synopsis

A nil-pointer dereference in the free5GC Session Management Function (SMF) allows any unauthenticated network attacker to crash the SMF process with a single HTTP DELETE request. The SMF's UPI route group lacks OAuth2 authentication middleware, and the DELETE /upi/v1/upNodesLinks/{ref} handler dereferences a UPF object that is never populated for AN-typed nodes, triggering a Go nil-pointer panic. Successful exploitation crashes the SMF handler and permanently mutates the in-memory user-plane topology before the panic fires, causing service disruption and unauthorized topology changes. A patched-image rebuild at version 4.2.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SMF's UPI HTTP management interface over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  The UPI route group is mounted without OAuth2 middleware, so no credentials or session token are required to issue the malicious DELETE request.

• Victim interactionNot required

  Exploitation is fully attacker-driven; no user or operator action is needed to trigger the nil-pointer panic.

• Attack complexityDetail

  Exploitation is reliable and condition-free: a single correctly formed DELETE request to a known AN node name is sufficient with no timing, race, or memory-layout requirements.

Blast Radius

• Crashes the SMF handler process, taking Session Management Function availability offline and disrupting active 5G session establishment and modification for all connected UEs.
• Permanently removes the targeted AN node (e.g. gNB1) from the in-memory user-plane topology before the panic fires, silently corrupting the SMF's view of the network graph for the lifetime of the process.
• An attacker who enumerates multiple AN node names can chain repeated requests to progressively strip the user-plane topology, deepening the outage beyond a simple restart recovery.
• Integrity of the user-plane link state is compromised (CVSS I:L) because the topology mutation is not rolled back on panic, meaning restarting the SMF does not automatically restore the deleted node entry.