PT-2026-64644 · Linux · Linux
CVE-2026-64423
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
ipv4: igmp: remove multicast group from hash table on device destruction
When a device is destroyed under RTNL, ip mc destroy dev() iterates through
the multicast list and calls ip ma put() on each membership, scheduling
them for RCU reclamation. However, they are not unlinked from the device's
multicast hash table (mc hash).
Since the device remains published in dev->ip ptr until after
ip mc destroy dev() completes, concurrent RCU readers traversing mc hash
can still locate and access the multicast group after its refcount is
decremented. If the RCU callback runs and frees the group while a reader is
accessing it, a use-after-free occurs.
Fix this by unlinking the multicast group from mc hash using
ip mc hash remove() before scheduling it for reclamation.
BUG: KASAN: slab-use-after-free in ip check mc rcu+0x149/0x3f0
Read of size 4 at addr ffff888009bf1408 by task mausezahn/2276
Call Trace:
dump stack lvl+0x67/0x90
print report+0x175/0x7c0
kasan report+0x147/0x180
ip check mc rcu+0x149/0x3f0
udp v4 early demux+0x36d/0x12d0
ip rcv finish core+0xb8b/0x1390
ip rcv finish+0x54/0x120
NF HOOK+0x213/0x2b0
netif receive skb+0x126/0x340
process backlog+0x4f2/0xf00
napi poll+0x92/0x2c0
net rx action+0x583/0xc60
handle softirqs+0x236/0x7f0
do softirq+0x57/0x80
Allocated by task 2239:
kasan save track+0x3e/0x80
kasan kmalloc+0x72/0x90
ip mc inc group+0x31a/0xa40
ip mc join group+0x334/0x3f0
do ip setsockopt+0x16fa/0x2010
ip setsockopt+0x3f/0x90
do sock setsockopt+0x1ad/0x300
Freed by task 0:
kasan save track+0x3e/0x80
kasan save free info+0x40/0x50
kasan slab free+0x3a/0x60
rcu free sheaf prepare+0xd4/0x220
rcu free sheaf+0x36/0x190
rcu core+0x8d9/0x12f0
handle softirqs+0x236/0x7f0
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux