CVE-2026-72323

Received Received - Intake

Use-After-Free in Linux Kernel IGMP Timer

Publication date: 2026-08-15

Last updated on: 2026-09-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() A race condition exists between device teardown (inetdev_destroy) and incoming IGMP query processing (igmp_rcv), leading to a Use-After-Free in the IGMP timer callback. During device destruction, inetdev_destroy() drops the primary reference to in_device, which can drop its refcount to 0. The actual freeing of in_device memory is deferred via RCU (using call_rcu()). Concurrently, igmp_rcv() runs under RCU read lock and obtains the in_device pointer. Because the memory is RCU-protected, CPU-0 can safely dereference in_device even if its refcount has hit 0. However, if CPU-0 calls igmp_gq_start_timer() and re-arms the timer, it attempts to acquire a reference using in_dev_hold(). This increments the refcount from 0 to 1, triggering a "refcount_t: addition on 0" warning. Since the in_device memory is still scheduled to be freed after the RCU grace period (as the free callback does not check the refcount again), the device is freed while the timer is still armed. When the timer expires, it accesses the freed memory, causing a kernel panic. Fix this by using refcount_inc_not_zero() (via a new helper in_dev_hold_safe()) to prevent acquiring a reference if the device is already being destroyed. If the refcount is 0, we do not arm the timer. A similar issue in IPv6 MLD is fixed in a subsequent patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-09-02

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72323

EUVD

EUVD-2026-59222

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Use-After-Free (UAF) vulnerability in the Linux kernel's IPv4 IGMP implementation. A race condition occurs between device teardown and incoming IGMP query processing, causing a timer callback to access freed memory. The issue arises when a device's reference count drops to zero during teardown but memory is freed later via RCU. If a timer is rearmed while the refcount is zero, it increments the count and later accesses freed memory, leading to a kernel panic.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPv4 IGMP handling and may not have direct detection commands. Monitor kernel logs for refcount warnings or kernel panics related to in_device or IGMP timers. Check for crashes during network device teardown or IGMP processing.

Impact Analysis

This vulnerability can cause system crashes (kernel panics) on Linux systems using IPv4 IGMP. Attackers on the local network could trigger the race condition by sending malicious IGMP queries, leading to denial-of-service conditions. Systems relying on network connectivity or real-time operations are most affected.

Compliance Impact

This vulnerability is a kernel-level issue in the Linux IPv4 IGMP protocol handling that could lead to a kernel panic due to a Use-After-Free (UAF) condition. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than kernel stability. However, a kernel panic could cause system unavailability, potentially disrupting services that handle sensitive data, indirectly impacting compliance if availability is a requirement.

Mitigation Strategies

Apply the kernel patch that fixes this issue by using refcount_inc_not_zero() for in_device references. Update to a Linux kernel version that includes the fix for CVE-2026-72323. Monitor for refcount warnings in kernel logs as an indicator of exploitation.

Hi! I’m here to help you understand CVE-2026-72323. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70