CVE-2026-64423 Overview
CVE-2026-64423 is a use-after-free vulnerability in the Linux kernel's IPv4 Internet Group Management Protocol (IGMP) implementation. The flaw resides in ip_mc_destroy_dev(), which fails to unlink multicast group memberships from the device's multicast hash table (mc_hash) before scheduling them for Read-Copy-Update (RCU) reclamation. Concurrent RCU readers can locate a freed multicast group through the still-published dev->ip_ptr pointer, triggering a use-after-free condition detected by Kernel Address Sanitizer (KASAN). The vulnerability affects local kernel memory safety and can lead to memory corruption, information disclosure, or privilege escalation on affected Linux systems.
Critical Impact
A local attacker with low privileges can trigger a use-after-free in kernel network stack memory, potentially resulting in arbitrary kernel code execution or complete system compromise.
Affected Products
- Linux kernel IPv4 IGMP subsystem (net/ipv4/igmp.c)
- Linux kernel versions prior to the fix commits listed in stable branches
- Linux distributions shipping vulnerable kernel builds
Discovery Timeline
- 2026-07-25 - CVE-2026-64423 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-64423
Vulnerability Analysis
The vulnerability originates in the multicast group cleanup path when a network device is destroyed under the Routing Netlink (RTNL) lock. The function ip_mc_destroy_dev() iterates through the multicast list and invokes ip_ma_put() on each membership, which decrements the reference count and schedules the group for RCU reclamation. However, the routine omits a call to ip_mc_hash_remove(), leaving stale pointers to the freed group inside mc_hash.
Because dev->ip_ptr remains published until after ip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash through paths such as ip_check_mc_rcu() and udp_v4_early_demux() can still resolve the group. When the deferred RCU callback frees the object while another CPU is dereferencing it, the reader operates on freed slab memory. KASAN reports this as a slab-use-after-free in ip_check_mc_rcu+0x149/0x3f0 during softirq packet processing.
Root Cause
The root cause is missing hash table unlinking in the multicast device destruction path. The refcount-based cleanup contract assumes readers cannot reach an object once its final reference is dropped, but leaving the group discoverable in mc_hash violates that invariant and creates a race window between RCU reclamation and RCU-protected lookups.
Attack Vector
An attacker with local access and the ability to create sockets can join and leave IPv4 multicast groups through setsockopt() with IP_ADD_MEMBERSHIP and IP_DROP_MEMBERSHIP. By repeatedly triggering device teardown paths that invoke ip_mc_destroy_dev() while concurrently sending multicast UDP traffic on another CPU, an attacker can race the RCU grace period and dereference freed memory in the kernel network stack. Successful exploitation may yield kernel memory corruption suitable for privilege escalation.
The patch adds an ip_mc_hash_remove() call before scheduling each multicast group for RCU reclamation. Reference the Linux kernel stable commits (2ca18df1, 412ba7df, and f9188303) for the complete fix.
Detection Methods for CVE-2026-64423
Indicators of Compromise
- KASAN reports containing slab-use-after-free in ip_check_mc_rcu in kernel logs (dmesg, /var/log/kern.log)
- Unexpected kernel oopses, panics, or general protection faults referencing ip_check_mc_rcu, udp_v4_early_demux, or ip_rcv_finish_core
- Unusual process patterns creating and destroying network namespaces or virtual interfaces at high frequency
Detection Strategies
- Monitor kernel ring buffer output for slab corruption warnings and RCU stall messages tied to IGMP code paths
- Audit local processes invoking IP_ADD_MEMBERSHIP and IP_DROP_MEMBERSHIPsetsockopt() calls in tight loops via eBPF or auditd rules
- Track network namespace creation and teardown events, particularly from unprivileged user sessions
Monitoring Recommendations
- Enable KASAN on non-production test kernels to surface use-after-free conditions during fuzzing or QA
- Correlate kernel crash telemetry with authentication logs to identify local users whose activity precedes crashes
- Aggregate kernel log data centrally so multicast-related fault signatures can be searched across the fleet
How to Mitigate CVE-2026-64423
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable commits and reboot affected hosts
- Prioritize patching multi-tenant systems, container hosts, and Kubernetes nodes where untrusted local workloads execute
- Inventory kernel versions across Linux endpoints and servers to identify unpatched systems
Patch Information
The fix has been merged into Linux kernel stable branches through commits 2ca18df1, 412ba7df, 5f42729d, 76d030ac, 7993211b, 8820b530, c6cb5f8e, and f9188303. Consume the fix through your distribution's security update channel (for example, apt, dnf, or zypper) once the vendor packages the corrected kernel.
Workarounds
- Restrict unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 where feasible to reduce local attacker capability
- Limit local shell access on shared systems and apply seccomp or AppArmor profiles to constrain socket operations from untrusted workloads
- Disable IPv4 multicast on interfaces where it is not required using sysctl settings such as net.ipv4.conf.all.force_igmp_version tuning combined with firewall rules blocking multicast traffic
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
