Description

A security vulnerability has been detected in Linux Foundation Magma 1.9.0. Affected by this vulnerability is an unknown functionality of the file tasks/ngap/ngap_amf.c of the component gNB Termination Handler. The manipulation leads to denial of service. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-30T17:16:39.370Z",
  "pubdate": "2026-08-30T17:16:39.370Z",
  "executiveSummary": "A critical security vulnerability has been identified in the Linux Foundation Magma 1.9.0 release, specifically within the gNB Termination Handler component.\nThe flaw resides in the handling of network traffic processed by the tasks/ngap/ngap_amf.c source file.\nThe vulnerability is classified as a Denial of Service (DoS) condition, which can be triggered remotely by an unauthorized attacker.\nSuccessful exploitation results in the disruption of the AMF (Access and Mobility Management Function) service, potentially causing a total loss of connectivity for connected User Equipment (UE) and gNB nodes within the affected network sector.\nGiven that the exploit code has been disclosed publicly, the risk of active exploitation is significant, requiring immediate attention from network administrators.\nThe vulnerability does not require prior authentication to the target system, lowering the barrier to entry for potential adversaries capable of reaching the gNB termination interface.",
  "technicalDetails": "The vulnerability is located within the NGAP (Next Generation Application Protocol) stack handler, specifically in tasks/ngap/ngap_amf.c, which is responsible for managing the state and communication between the AMF and gNBs.\nThe root cause appears to be improper handling of malformed or unexpected NGAP message structures, which triggers an unhandled exception or resource exhaustion during the parsing or state transition phase of the termination process.\nThe attack flow initiates with an attacker sending a crafted NGAP packet to the AMF's gNB termination interface. Since the AMF must process incoming NGAP messages from potentially untrusted gNB connections, the interface is inherently exposed to remote inputs.\nWhen the ngap_amf.c component receives the malicious payload, the internal logic fails to validate the protocol data unit (PDU) correctly. This leads to a crash, memory corruption, or an infinite loop, effectively halting the execution of the gNB termination thread.\nBecause this functionality is critical for the AMF's operation, the termination of this thread leads to the inability of the system to manage gNB associations, handovers, and session management tasks.\nThe exploitation process does not require specialized credentials or pre-existing sessions. The attacker merely needs network reachability to the NGAP interface, typically accessible via the N2 reference point.\nPublic disclosure of the exploit indicates that the sequence of bytes required to trigger the fault is well-defined, allowing for automated or scripted attacks against Magma 1.9.0 deployments.\nPost-exploitation impact is characterized by a complete service outage for the affected AMF instance. In an NFV (Network Functions Virtualization) environment, if the Magma architecture does not implement robust service-level monitoring and auto-healing, the service may remain unavailable until manual intervention or a service restart is performed.\nThe nature of the crash suggests a vulnerability in state management or input validation within the NGAP finite state machine, where the component fails to handle out-of-order or anomalous messages during the gNB signaling lifecycle."
}