CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction
In the Linux kernel, the following vulnerability has been resolved:
ipv4: igmp: remove multicast group from hash table on device destruction
When a device is destroyed under RTNL, ipmcdestroydev() iterates through the multicast list and calls ipmaput() on each membership, scheduling them for RCU reclamation. However, they are not unlinked from the device's multicast hash table (mchash).
Since the device remains published in dev->ipptr until after ipmcdestroydev() completes, concurrent RCU readers traversing mchash can still locate and access the multicast group after its refcount is decremented. If the RCU callback runs and frees the group while a reader is accessing it, a use-after-free occurs.
Fix this by unlinking the multicast group from mchash using ipmchashremove() before scheduling it for reclamation.
BUG: KASAN: slab-use-after-free in ipcheckmcrcu+0x149/0x3f0 Read of size 4 at addr ffff888009bf1408 by task mausezahn/2276
Call Trace: <IRQ> dumpstacklvl+0x67/0x90 printreport+0x175/0x7c0 kasanreport+0x147/0x180 ipcheckmcrcu+0x149/0x3f0 udpv4earlydemux+0x36d/0x12d0 iprcvfinishcore+0xb8b/0x1390 iprcvfinish+0x54/0x120 NFHOOK+0x213/0x2b0 netifreceiveskb+0x126/0x340 processbacklog+0x4f2/0xf00 napipoll+0x92/0x2c0 netrxaction+0x583/0xc60 handlesoftirqs+0x236/0x7f0 dosoftirq+0x57/0x80 </IRQ>
Allocated by task 2239: kasansavetrack+0x3e/0x80 kasankmalloc+0x72/0x90 ipmcincgroup+0x31a/0xa40 ipmcjoingroup+0x334/0x3f0 doipsetsockopt+0x16fa/0x2010 ipsetsockopt+0x3f/0x90 dosocksetsockopt+0x1ad/0x300
Freed by task 0: kasansavetrack+0x3e/0x80 kasansavefreeinfo+0x40/0x50 kasanslabfree+0x3a/0x60 rcufreesheafprepare+0xd4/0x220 rcufreesheaf+0x36/0x190 rcucore+0x8d9/0x12f0 handlesoftirqs+0x236/0x7f0
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64423?
The severity of CVE-2026-64423 is rated as 53, indicating a moderate risk level.
How do I fix CVE-2026-64423?
To fix CVE-2026-64423, ensure you upgrade to the patched version of the Linux Kernel available after July 25, 2026.
What type of vulnerability is CVE-2026-64423?
CVE-2026-64423 is categorized as a Use After Free vulnerability in the Linux Kernel.
Which component is affected by CVE-2026-64423?
CVE-2026-64423 affects the IPv4 multicast group handling within the Linux Kernel.
What can happen if CVE-2026-64423 is exploited?
Exploitation of CVE-2026-64423 may lead to denial of service or arbitrary code execution due to mishandled multicast group destruction.