Executive brief
A vulnerability was identified in the Linux kernel's handling of IPv6 multicast network traffic. An attacker could potentially send specially crafted network packets to cause a system crash or instability. This affects the availability of any Linux-based system processing IPv6 multicast listener discovery (MLD) queries.
Technical details
A use-after-free (UAF) vulnerability exists in net/ipv6/mcast.c within the __mld_query_work function. When processing an MLD (Multicast Listener Discovery) query, the kernel retrieves a pointer to the multicast group address from the socket buffer (skb) header. However, subsequent calls to pskb_may_pull() can cause the skb header to be reallocated, invalidating the original pointer. If the kernel later dereferences this stale pointer without reloading it, a UAF occurs. The fix involves copying the multicast group address into a local variable during initial parsing to ensure it remains valid regardless of skb header reallocations. This can be triggered by remote network traffic and results in a kernel panic (DoS).
Affected products
- Linux Linux Kernel All versions prior to the June 2026 patches
Timeline
- 2026-06-03: disclosed: Initial patch submitted by Ido Schimmel
- 2026-06-19: patched: Patches committed to stable kernel trees
- 2026-06-25: advisory: CVE-2026-53275 published
References
- https://git.kernel.org/stable/c/087dbacf897c020f438f780f0a4a8aa73b6d7c5a
- https://git.kernel.org/stable/c/1354271c89d0e5fbf8b3d94097ff0216695209c7
- https://git.kernel.org/stable/c/2a613bf497029d555a7428406aa8cdb84a503cea
- https://git.kernel.org/stable/c/4203806f700bb44ea0b05d484d9d40044b47fb04
- https://git.kernel.org/stable/c/53baa63a4183291574483f89583dbef13677a2c4
- https://git.kernel.org/stable/c/791c91dc7a9dfb2457d5e29b8216a6484b9c4b40
- https://git.kernel.org/stable/c/b2eb8886200b907fc71806869620609f0f4cacb0