Executive brief
A vulnerability was identified in the Linux kernel's networking component that could lead to a system crash. The issue occurs when a network device is removed while the system is still processing certain types of background network traffic (multicast). This could potentially be exploited to cause a denial-of-service, impacting the availability of the affected server or device.
Technical details
A use-after-free (UAF) vulnerability exists in net/ipv4/igmp.c within the Linux kernel. When a network device is destroyed, the function ip_mc_destroy_dev() decrements the reference count of multicast group memberships but fails to unlink them from the device's multicast hash table (mc_hash). Because the device remains visible to RCU readers until the destruction process completes, concurrent readers can still access these groups. If the RCU callback frees the group memory while a reader is still traversing the hash table, a UAF occurs, as evidenced by KASAN reports in ip_check_mc_rcu. This is fixed by ensuring ip_mc_hash_remove() is called before scheduling reclamation.
Affected products
- Linux Linux Kernel e9897071350b to 7993211bde16
Timeline
- 2026-07-25: disclosed: CVE-2026-64423 published
- 2026-07-18: patched: Fix committed to stable tree
References
- https://git.kernel.org/stable/c/2ca18df1c2611f70eb3eb487e02ae85eb703b284
- https://git.kernel.org/stable/c/412ba7def06ffe974ba9a1d862b022362c54ffa5
- https://git.kernel.org/stable/c/5f42729d74bd6c61306d864423290d92962de4e1
- https://git.kernel.org/stable/c/76d030ac95e17f91d69a595f17ebc5979700cf9a
- https://git.kernel.org/stable/c/7993211bde166471dffac074dc965489f86531f8
- https://git.kernel.org/stable/c/8820b530cb2388503d7418228d03ba074bf7a03e
- https://git.kernel.org/stable/c/c6cb5f8ebe1c1a78710c19f102db9fe48b9e6ba9