CVE-2026-89564: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89564 Overview

CVE-2026-89564 is a use-after-free vulnerability in the Linux kernel's IPv4 and IPv6 multicast forwarding paths. The flaw occurs when the kernel preserves an skb->sk association from bpf_sk_assign() or UDP early demux without holding a reference to the socket. When a multicast packet is handed to ip_mr_input() or ip6_mr_input() for forwarding, the skb can be queued on an unresolved route or transmitted after the receive-side RCU section ends. If the prefetched socket is destroyed in the interim, a later skb free triggers sock_pfree(), which dereferences the stale pointer.

Critical Impact
Local exploitation can corrupt kernel memory, resulting in privilege escalation, denial of service, or arbitrary kernel code execution on affected systems.

Affected Products

Linux kernel versions containing bpf_sk_assign() support and multicast forwarding via ip_mr_input() / ip6_mr_input()
Distributions shipping vulnerable stable kernel branches prior to the patch commits
Systems with multicast routing (CONFIG_IP_MROUTE, CONFIG_IPV6_MROUTE) enabled

Discovery Timeline

2026-09-11 - CVE-2026-89564 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89564

Vulnerability Analysis

The Linux kernel networking stack preserves the skb->sk association across IPv4 and IPv6 input processing so that local delivery can route packets to a socket selected by an eBPF program using bpf_sk_assign(). UDP early demux performs similar socket prefetching. In both cases, the kernel does not guarantee that a reference is held on the referenced socket, relying instead on RCU protection during the receive path.

The defect emerges when a multicast packet cannot be delivered locally. IPv6 invokes ip6_mr_input() and IPv4 invokes ip_mr_input(), both of which retain the original skb rather than cloning it. These functions may enqueue the skb on an unresolved multicast route or forward it after the RCU read-side critical section terminates. Once the RCU grace period elapses and the prefetched socket is freed, any subsequent skb release calls sock_pfree() on the dangling skb->sk, producing a use-after-free condition.

Root Cause

The root cause is a lifetime mismatch between RCU-protected socket prefetches and skb objects that outlive the receive-side RCU section. The multicast forwarding paths inherited an skb->sk reference intended solely for local delivery, without accounting for cross-RCU-section skb queueing.

Attack Vector

Exploitation requires local access and the ability to influence multicast traffic paths. An attacker with CAP_BPF or the ability to install a socket-assigning eBPF program can craft conditions where a multicast skb carries a prefetched socket pointer, then trigger socket destruction before the skb is freed by the forwarding subsystem.

No verified public exploit code is available. The upstream fix orphans the skb before each non-local multicast forwarding path, and existing skb_clone() calls continue to supply socket-free clones to multicast forwarding. See the kernel commit a8af6fb, commit e36ce6e, and commit f1281d4 for the corrective patches.

Detection Methods for CVE-2026-89564

Indicators of Compromise

Kernel oops or panic traces referencing sock_pfree, ip_mr_input, or ip6_mr_input
KASAN use-after-free reports on socket structures during multicast forwarding
Unexpected process termination in multicast-heavy workloads combined with eBPF socket assignment

Detection Strategies

Enable KASAN on test kernels to surface use-after-free access on skb->sk during multicast forwarding
Audit loaded eBPF programs for bpf_sk_assign() usage against processes without CAP_BPF legitimacy
Monitor kernel ring buffer messages for stack traces implicating multicast input handlers

Monitoring Recommendations

Track kernel version inventory and flag hosts running unpatched stable branches referenced in the upstream commits
Log eBPF program load events via audit rules on bpf() syscalls
Alert on repeated kernel warnings from net/ipv4/ipmr.c or net/ipv6/ip6mr.c

How to Mitigate CVE-2026-89564

Immediate Actions Required

Apply the upstream stable kernel patches referenced by commits a8af6fb, e36ce6e, and f1281d4
Update to distribution kernel packages that incorporate the fix
Restrict CAP_BPF and CAP_NET_ADMIN to trusted administrators only

Patch Information

The fix orphans the skb before each non-local multicast forwarding path, ensuring that stale socket pointers cannot be dereferenced after the RCU section ends. Local delivery retains the original skb with its socket association, while multicast forwarding operates on socket-free clones produced by existing skb_clone() calls. Patches are available in the mainline and stable trees; consult the kernel git references for exact backport targets.

Workarounds

Disable IPv4 and IPv6 multicast routing where operationally feasible by unloading ip_mr and ip6_mr modules or building kernels without CONFIG_IP_MROUTE and CONFIG_IPV6_MROUTE
Remove or restrict eBPF programs that call bpf_sk_assign() on multicast-capable interfaces
Limit unprivileged eBPF via kernel.unprivileged_bpf_disabled=1

bash

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
modprobe -r ip_mr ip6_mr