UBUNTU-CVE-2026-72321: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks in igmpmodtimer() and igmpstoptimer() When a timer is deleted and not re-armed in igmpmodtimer(), or stopped in igmpstoptimer(), the code currently decrements the reference counter of the multicast list entry @im using refcountdec(&im->refcnt). However, both functions can be called from the RCU reader path: - igmpmodtimer() via igmpheardquery() -> foreachpmcrcu() - igmpstoptimer() via igmprcv() -> igmpheardreport() If the group im was concurrently removed from the list by ipmcdecgroup(), its reference count might have already been decremented to 1. In this case, timerdelete() succeeds, and refcountdec() decrements the refcount from 1 to 0. Since refcountdec() does not free the object when it hits 0 (unlike ipmaput()), the im structure is leaked. Fix this by using ipmaput(im) instead of refcountdec(&im->refcnt), and deferring the put until after the spinlock is released.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In the Linux kernel IPv4 IGMP code, replace refcount_dec(&im->refcnt) with ip_ma_put(im) in igmp_mod_timer() and igmp_stop_timer(), and defer the put until after the spinlock is released.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The listed affected packages are ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-gcp, and ubuntu/linux-gcp-fips.
What conditions are required to trigger the leak?
The issue involves IGMP multicast-list entries being concurrently removed while timer handling runs from an RCU reader path. The affected paths are reached while processing IGMP queries or reports, and successful timer deletion or stopping can then drop the final reference without freeing the entry.
What is the impact if the issue is triggered?
A multicast-list entry can remain allocated after its reference count reaches zero, causing a kernel memory leak. The supplied severity vector indicates availability impact only, with no stated confidentiality or integrity impact.