CVE-2026-64423

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the IPv4 IGMP implementation during device destruction under RTNL. The function ip mc destroy dev() iterates through the multicast list and calls ip ma put() to schedule memberships for RCU (Read-Copy-Update) reclamation, but fails to unlink them from the device's multicast hash table mc hash. Because the device remains published in dev->ip ptr until the process completes, concurrent RCU readers can still access the multicast group after its reference count has decreased. If the RCU callback frees the group while a reader is accessing it, a memory corruption occurs. This was observed in the ip check mc rcu() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.