CVE-2026-72322

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition occurs between device teardown and incoming Multicast Listener Discovery (MLD) query processing. During device destruction, the primary reference to inet6 dev is dropped, potentially reducing its reference count to 0. While the memory is RCU-protected, allowing safe dereferencing, a call to the igmp6 event query() function may attempt to acquire a reference using in6 dev hold(). This can increment the reference count from 0 to 1, which triggers a warning and allows the device to be freed while work is still scheduled. When the scheduled work eventually executes, it accesses the freed memory, resulting in a Use-After-Free (UAF) condition and a kernel panic. RCU (Read-Copy-Update) is a synchronization mechanism that allows multiple readers to access data while it is being updated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.