CVE-2026-72321: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()
In the Linux kernel, the following vulnerability has been resolved:
ipv4: igmp: Fix potential memory leaks in igmpmodtimer() and igmpstoptimer()
When a timer is deleted and not re-armed in igmpmodtimer(), or stopped in igmpstoptimer(), the code currently decrements the reference counter of the multicast list entry @im using refcountdec(&im->refcnt).
However, both functions can be called from the RCU reader path: - igmpmodtimer() via igmpheardquery() -> foreachpmcrcu() - igmpstoptimer() via igmprcv() -> igmpheardreport()
If the group im was concurrently removed from the list by ipmcdecgroup(), its reference count might have already been decremented to 1.
In this case, timerdelete() succeeds, and refcountdec() decrements the refcount from 1 to 0. Since refcountdec() does not free the object when it hits 0 (unlike ipmaput()), the im structure is leaked.
Fix this by using ipmaput(im) instead of refcountdec(&im->refcnt), and deferring the put until after the spinlock is released.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel ipv4: igmpto a version that resolves this vulnerability.Fixed in resolved - Configuration
In igmp_mod_timer() (called via igmp_heard_query() -> for_each_pmc_rcu()), replace refcount_dec(&im->refcnt) with ip_ma_put(im) so the object is freed correctly; in igmp_stop_timer() (called via igmp_rcv() -> igmp_heard_report()), defer the put until after the spinlock is released to avoid the concurrent ip_mc_dec_group() race and prevent reference-count-to-0 leaks.
Linux kernel ipv4/igmp refcount_dec(&im->refcnt) -> ip_ma_put(im) = use ip_ma_put(im) instead of refcount_dec(&im->refcnt) in igmp_mod_timer() and igmp_stop_timer()