EUVD-2026-76475
GHSA-94m9-vxgj-4qq7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition between socket destruction and multicast forwarding requires AC:H; non-default multicast routing configuration and local access required.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ip: orphan prefetched skbs before multicast forwarding
IPv4 and IPv6 input preserve an skb->sk association installed by bpf_sk_assign() so that local delivery can use the selected socket under RCU. Both address families can also prefetch a socket in UDP early demux. In both paths (BPF and UDP early demux) a reference is not guaranteed to be held on the socket.
When a multicast packet is not locally deliverable, IPv6 hands the original skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the original skb when local delivery is not needed. Either path can put the skb on an unresolved multicast route queue or forward it after the receive-side RCU section ends.
After the prefetched socket is destroyed, a later skb free invokes sock_pfree() and dereferences the stale skb->sk. Orphan the skb before each non-local multicast forwarding path. Local delivery retains the original skb; the existing skb_clone() calls provide multicast forwarding with a socket-free clone.
AnalysisAI
Use-after-free in the Linux kernel's IPv4 and IPv6 multicast forwarding paths allows a local attacker to corrupt kernel memory by racing socket destruction against multicast skb forwarding. The flaw arises because bpf_sk_assign() and UDP early demux can associate a socket pointer (skb->sk) with a socket buffer without holding a counted reference; when ip_mr_input() or ip6_mr_input() forwards the original skb outside the RCU read section, a concurrently destroyed socket leaves skb->sk stale, and the eventual sock_pfree() call dereferences freed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local system access with sufficient privilege to either: (a) load a BPF program using `bpf_sk_assign()` (requiring CAP_BPF or CAP_NET_ADMIN depending on kernel configuration), or (b) trigger UDP early demux on a system with multicast traffic flowing through it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-provided CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) moderately overstates real-world exploitability: the AC:L metric is inconsistent with the timing-dependent race condition between socket destruction and multicast forwarding, which would more accurately be characterized as AC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patches available in Linux kernel 6.18.50, 7.2.4, or 7.3-rc1 via the stable-branch commits at git.kernel.org linked above. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit which systems run vulnerable Linux kernel versions and document the population of local system users with network capabilities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today