Bug ID 2198757: PEM: use-after-free of mw_msg in session_del_msg_entries hash

Last Modified: May 05, 2026

Affected Product(s):
BIG-IP PEM(all modules)

Known Affected Versions:
16.1.5, 16.1.5.1, 16.1.5.2, 16.1.6, 16.1.6.1, 17.1.2, 17.1.2.1, 17.1.2.2, 17.1.3, 17.1.3.1, 17.5.0, 17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 21.0.0, 21.0.0.1

Fixed In:
17.5.1.6, 17.1.3.2

Opened: Jan 02, 2026

Severity: 3-Major

Symptoms

There is a rare scenario where tmm crashes while passing PEM traffic.

Impact

Traffic disrupted while tmm restarts.

Conditions

-- PEM is licensed and enabled. -- Policies are assigned from the PCRF. Subscriber additions and deletions are happening regularly.

Workaround

None.

Fix Information

The delayed response or timeout of the request is now handled gracefully.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips