Executive brief
The Linux kernel's IPv4 IGMP (Internet Group Management Protocol) implementation contains a use-after-free vulnerability in timer handling that can lead to kernel panics. When a network device is destroyed while IGMP timer callbacks are still pending, freed memory is accessed by the timer, causing system crashes. This affects all systems running Linux that process IGMP multicast queries.
Technical details
A race condition exists between device teardown (inetdev_destroy) and incoming IGMP query processing (igmp_rcv). During device destruction, the in_device reference count drops to 0, but the actual memory freeing is deferred via RCU. Concurrently, igmp_rcv() can call igmp_gq_start_timer(), which attempts to increment the refcount from 0 via in_dev_hold(), violating refcount safety semantics. The in_device is then freed while the timer remains armed, causing a kernel panic when the timer expires and accesses the freed memory. The fix uses refcount_inc_not_zero() to safely detect and prevent arming timers when the device is already being destroyed, eliminating the race condition.
Affected products
- Linux Linux Kernel 2.6.12 and later (pre-2026-07-05)
Timeline
- 2026-08-15: disclosed: CVE-2026-72323 published to NVD
- 2026-07-05: patched: Fix committed by Eric Dumazet (commit 7b19c0f81ed1fdaec6bc522569be367199a9edf3)
- 2026-07-24: other: Fix backported to stable kernel branches