PT-2026-64644 · Linux · Linux

CVE-2026-64423

·

Published

2026-07-25

·

Updated

2026-07-25

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
ipv4: igmp: remove multicast group from hash table on device destruction
When a device is destroyed under RTNL, ip mc destroy dev() iterates through the multicast list and calls ip ma put() on each membership, scheduling them for RCU reclamation. However, they are not unlinked from the device's multicast hash table (mc hash).
Since the device remains published in dev->ip ptr until after ip mc destroy dev() completes, concurrent RCU readers traversing mc hash can still locate and access the multicast group after its refcount is decremented. If the RCU callback runs and frees the group while a reader is accessing it, a use-after-free occurs.
Fix this by unlinking the multicast group from mc hash using ip mc hash remove() before scheduling it for reclamation.
BUG: KASAN: slab-use-after-free in ip check mc rcu+0x149/0x3f0 Read of size 4 at addr ffff888009bf1408 by task mausezahn/2276
Call Trace: dump stack lvl+0x67/0x90 print report+0x175/0x7c0 kasan report+0x147/0x180 ip check mc rcu+0x149/0x3f0 udp v4 early demux+0x36d/0x12d0 ip rcv finish core+0xb8b/0x1390 ip rcv finish+0x54/0x120 NF HOOK+0x213/0x2b0 netif receive skb+0x126/0x340 process backlog+0x4f2/0xf00 napi poll+0x92/0x2c0 net rx action+0x583/0xc60 handle softirqs+0x236/0x7f0 do softirq+0x57/0x80
Allocated by task 2239: kasan save track+0x3e/0x80 kasan kmalloc+0x72/0x90 ip mc inc group+0x31a/0xa40 ip mc join group+0x334/0x3f0 do ip setsockopt+0x16fa/0x2010 ip setsockopt+0x3f/0x90 do sock setsockopt+0x1ad/0x300
Freed by task 0: kasan save track+0x3e/0x80 kasan save free info+0x40/0x50 kasan slab free+0x3a/0x60 rcu free sheaf prepare+0xd4/0x220 rcu free sheaf+0x36/0x190 rcu core+0x8d9/0x12f0 handle softirqs+0x236/0x7f0
Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

CVE-2026-64423

Affected Products

Linux