HIGH Introduced in 5.7
ip MulticastFwd UAF
CVE-2026-89564
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an skb->sk association installed by bpf_sk_assign() so that local delivery can use the selected socket under RCU. Both address families can also prefetch a socket in UDP early demux. In both paths (BPF and UDP early demux) a reference is not guaranteed to be held on the socket. When a multicast packet is not locally deliverable, IPv6 hands the original skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the original skb when local delivery is not needed. Either path can put the skb on an unresolved multicast route queue or forward it after the receive-side RCU section ends. After the prefetched socket is destroyed, a later skb free invokes sock_pfree() and dereferences the stale skb->sk. Orphan the skb before each non-local multicast forwarding path. Local delivery retains the original skb; the existing skb_clone() calls provide multicast forwarding with a socket-free clone.
02KernelScan AI Analysis
Risk summary
A remote attacker can trigger a use-after-free in the kernel's IP multicast routing code by sending multicast packets to a host with multicast routing configured. The stale socket pointer dereference can lead to kernel memory corruption, potentially resulting in code execution or a system crash.
Vulnerability analysis
When a multicast packet arrives at a host with multicast routing enabled, the IP input path may associate a socket with the packet buffer through BPF socket assignment or UDP early demux without holding a reference on that socket. If the packet is not locally deliverable and is instead queued for multicast forwarding, the socket may be destroyed before the packet buffer is freed. When the buffer is eventually released, its destructor dereferences the now-stale socket pointer, causing a use-after-free. The fix clears the socket association from the packet buffer before it enters the multicast forwarding path, so the destructor no longer touches the freed socket. An attacker can trigger this by sending multicast packets to a host that has multicast routing configured; the race window depends on the prefetched socket being closed while the packet is still in flight.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 5.7 | 6.12.111 | e62aef7d6a5b |
| 6.18 | 5.7 | 6.18.50 | a8af6fbac895 |
| 6.6 | 5.7 | 6.6.160 | 882212d317a7 |
| 7.2 | 5.7 | 7.2.4 | f1281d4b9908 |
| mainline | 5.7 | 7.3 | e36ce6e78fe3 |
| cip/6.12 | 5.7 | 6.12.111-cip32 | e62aef7d6a5b |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |