Executive brief
The Linux kernel's IGMP (Internet Group Management Protocol) subsystem contains a memory leak in timer handling functions. When multicast group timers are deleted or stopped under concurrent operations, reference counting logic fails to properly free allocated memory structures, causing gradual memory exhaustion. This affects systems using multicast networking, potentially leading to denial of service through memory depletion.
Technical details
A reference counting bug exists in igmp_mod_timer() and igmp_stop_timer() functions in the Linux kernel's IPv4 IGMP implementation. When a timer is deleted and not re-armed, the code calls refcount_dec() to decrement the reference counter of a multicast list entry. However, if the entry is concurrently removed via ip_mc_dec_group() from an RCU reader path, the reference count can reach zero without properly freeing the structure. Unlike ip_ma_put(), refcount_dec() does not invoke the freeing logic, causing a memory leak. The fix replaces refcount_dec() with ip_ma_put() and defers the operation until after spinlock release to maintain proper synchronization.
Affected products
- Linux Linux kernel 2.6.12 and later
Timeline
- 2026-08-15: disclosed
- 2026-07-05: patched: Upstream fix committed