Executive brief
A race condition in the Linux kernel's IPv6 multicast (MLD) handler can cause a kernel crash when network devices are destroyed while processing incoming multicast queries. This affects the core networking stack that handles IPv6 traffic on all Linux systems, potentially leading to denial of service and system unavailability.
Technical details
This vulnerability is a use-after-free (UAF) bug in the IPv6 multicast listener discovery (MLD) delayed work handler. The root cause is a race between device teardown and MLD query processing: when a network device is destroyed, its inet6_dev reference count drops to 0, but actual memory deallocation is deferred via RCU (Read-Copy-Update). Concurrently, the packet receive path can obtain a stale inet6_dev pointer under RCU lock and call igmp6_event_query(), which schedules delayed work and attempts to acquire a reference via in6_dev_hold(). This increments the refcount from 0 to 1 on memory already scheduled for deallocation, causing a kernel panic when the delayed work eventually executes. The fix uses refcount_inc_not_zero() (via a new in6_dev_hold_safe() helper) to prevent reference acquisition if the device is already being destroyed. No user interaction or authentication is required; the vulnerability is triggered by normal network operations during system shutdown or device hotplug. A patch is available and has been integrated into the Linux stable tree.
Affected products
- Linux Linux kernel 2.6.12 and later (prior to fix commit 9b26518b6896a16b809b1e42986f4ebac7bccc1e)
Timeline
- 2026-08-15: disclosed: CVE-2026-72322 published
- 2026-07-24: patched: Fix integrated into Linux stable tree