UBUNTU-CVE-2026-89564: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an skb->sk association installed by bpfskassign() so that local delivery can use the selected socket under RCU. Both address families can also prefetch a socket in UDP early demux. In both paths (BPF and UDP early demux) a reference is not guaranteed to be held on the socket. When a multicast packet is not locally deliverable, IPv6 hands the original skb to ip6mrinput(). IPv4's ipmrinput() similarly keeps the original skb when local delivery is not needed. Either path can put the skb on an unresolved multicast route queue or forward it after the receive-side RCU section ends. After the prefetched socket is destroyed, a later skb free invokes sockpfree() and dereferences the stale skb->sk. Orphan the skb before each non-local multicast forwarding path. Local delivery retains the original skb; the existing skbclone() calls provide multicast forwarding with a socket-free clone.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Orphan the skb before each non-local multicast forwarding path, including IPv4 ip_mr_input() and IPv6 ip6_mr_input(), so multicast-forwarded skbs do not retain a potentially stale skb->sk association.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The affected Ubuntu kernel packages listed are linux, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-riscv, and linux-gkeop. Exposure is tied to IPv4 or IPv6 multicast traffic that takes a non-local multicast forwarding path.
What conditions are required to trigger the stale socket reference?
The packet must retain a socket association obtained through bpf_sk_assign() or UDP early demultiplexing without a guaranteed socket reference. It must then be queued or forwarded through multicast handling after the receive-side RCU section, and the associated socket must be destroyed before the skb is later freed.
Are multicast packets delivered locally affected in the same way?
No. The fix description states that local delivery retains the original skb, while multicast forwarding uses a socket-free clone; the problematic handling is the non-local multicast forwarding path.