CVE-2026-72322

Received Received - Intake

Use-After-Free in Linux Kernel IPv6 Multicast

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary reference to inet6_dev is dropped, which can drop its refcount to 0. The actual freeing of inet6_dev memory is deferred via RCU. Concurrently, the packet receive path runs under RCU read lock and obtains the inet6_dev pointer. Because the memory is RCU-protected, CPU-0 can safely dereference inet6_dev even if its refcount has hit 0. However, if CPU-0 calls igmp6_event_query() and schedules delayed work, it attempts to acquire a reference using in6_dev_hold(). This increments the refcount from 0 to 1, triggering a "refcount_t: addition on 0" warning. Since the inet6_dev memory is still scheduled to be freed after the RCU grace period, the device is freed while the work is still scheduled. When the work runs, it accesses the freed memory, causing a kernel panic. Fix this by using refcount_inc_not_zero() (via a new helper in6_dev_hold_safe()) to prevent acquiring a reference if the device is already being destroyed. If the refcount is 0, we do not schedule the work.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72322

EUVD

EUVD-2026-59221

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Use-After-Free (UAF) vulnerability in the Linux kernel's IPv6 multicast handling. A race condition occurs during device teardown and incoming MLD query processing. When a device is destroyed, its reference count drops to zero but memory is freed later via RCU. If delayed work is scheduled while the memory is still accessible but about to be freed, it can access freed memory, causing a kernel panic.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPv6 multicast handling. Detection requires checking kernel logs for refcount warnings or kernel panics related to MLD delayed work. Monitor logs with: dmesg | grep -i "refcount_t\|MLD\|UAF". If you suspect exploitation, inspect kernel crash dumps or enable kernel debug flags like CONFIG_DEBUG_ATOMIC_SLEEP.

Impact Analysis

This vulnerability can cause system crashes (kernel panics) on Linux systems using IPv6 multicast. Attackers could exploit it to trigger denial-of-service conditions, leading to system instability or unavailability.

Compliance Impact

This vulnerability is a kernel-level issue in the Linux IPv6 multicast subsystem that could lead to a kernel panic via a use-after-free condition. It does not directly impact data privacy or security controls required by standards like GDPR or HIPAA, as it is not a data exposure or access control flaw. However, a kernel panic could cause system instability or denial of service, potentially disrupting compliance with availability requirements in regulated environments.

Mitigation Strategies

Apply the latest Linux kernel patches addressing CVE-2026-72322. If patching is not immediately possible, disable IPv6 multicast or restrict network access to trusted sources. Monitor vendor advisories for updates and consider isolating affected systems until patched.

Hi! I’m here to help you understand CVE-2026-72322. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70