CVE-2026-64423

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv4: igmp: remove multicast group from hash table on device destruction<br /> <br /> When a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through<br /> the multicast list and calls ip_ma_put() on each membership, scheduling<br /> them for RCU reclamation. However, they are not unlinked from the device&amp;#39;s<br /> multicast hash table (mc_hash).<br /> <br /> Since the device remains published in dev-&gt;ip_ptr until after<br /> ip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash<br /> can still locate and access the multicast group after its refcount is<br /> decremented. If the RCU callback runs and frees the group while a reader is<br /> accessing it, a use-after-free occurs.<br /> <br /> Fix this by unlinking the multicast group from mc_hash using<br /> ip_mc_hash_remove() before scheduling it for reclamation.<br /> <br /> BUG: KASAN: slab-use-after-free in ip_check_mc_rcu+0x149/0x3f0<br /> Read of size 4 at addr ffff888009bf1408 by task mausezahn/2276<br /> <br /> Call Trace:<br /> <br /> dump_stack_lvl+0x67/0x90<br /> print_report+0x175/0x7c0<br /> kasan_report+0x147/0x180<br /> ip_check_mc_rcu+0x149/0x3f0<br /> udp_v4_early_demux+0x36d/0x12d0<br /> ip_rcv_finish_core+0xb8b/0x1390<br /> ip_rcv_finish+0x54/0x120<br /> NF_HOOK+0x213/0x2b0<br /> __netif_receive_skb+0x126/0x340<br /> process_backlog+0x4f2/0xf00<br /> __napi_poll+0x92/0x2c0<br /> net_rx_action+0x583/0xc60<br /> handle_softirqs+0x236/0x7f0<br /> do_softirq+0x57/0x80<br /> <br /> <br /> Allocated by task 2239:<br /> kasan_save_track+0x3e/0x80<br /> __kasan_kmalloc+0x72/0x90<br /> ____ip_mc_inc_group+0x31a/0xa40<br /> __ip_mc_join_group+0x334/0x3f0<br /> do_ip_setsockopt+0x16fa/0x2010<br /> ip_setsockopt+0x3f/0x90<br /> do_sock_setsockopt+0x1ad/0x300<br /> <br /> Freed by task 0:<br /> kasan_save_track+0x3e/0x80<br /> kasan_save_free_info+0x40/0x50<br /> __kasan_slab_free+0x3a/0x60<br /> __rcu_free_sheaf_prepare+0xd4/0x220<br /> rcu_free_sheaf+0x36/0x190<br /> rcu_core+0x8d9/0x12f0<br /> handle_softirqs+0x236/0x7f0