Executive brief
The Linux kernel's network stack can crash or be exploited when processing multicast packets that are not delivered locally. When a socket reference is prefetched during UDP early demultiplexing or eBPF socket assignment, the kernel fails to properly clean up this reference before forwarding the packet to multicast routes. This can lead to accessing freed memory and potential denial of service or privilege escalation on systems processing multicast traffic.
Technical details
This vulnerability is a use-after-free in the IPv4 and IPv6 multicast input paths (ipmr.c and ip6_input.c). The root cause is that when BPF socket assignment or UDP early demux prefetches a socket reference into skb->sk, this reference is not released before the packet is forwarded via non-local multicast routes. After the prefetched socket is destroyed, the kernel later invokes sock_pfree() during skb cleanup, dereferencing a stale socket pointer. The vulnerability requires network reachability to send multicast packets but no authentication. The fix orphans the skb (clears the socket reference) before multicast forwarding in both IPv4 (ip_mr_input) and IPv6 (ip6_mc_input) paths, ensuring socket-free packets are used for multicast routes while preserving the reference for local delivery paths.
Affected products
- Linux Linux kernel Affected versions span linux-2.6.11 through linux-7.2, with stable backports across all maintained release branches. The vulnerability was introduced by commits cf7fbe660f2d (bpf: Add socket assign support) and 08842c43d016 (udp: no longer touch sk->sk_refcnt in early demux)
Timeline
- 2026-09-11: disclosed: CVE-2026-89564 published on NVD
- 2026-08-18: patched: Fix committed upstream as e36ce6e78fe3fc3c071a26750783b7ba081ce10d
- 2026-09-07: patched: Fix backported to stable tree as a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce