Cloudanix VulnDB

CVE-2026-89564

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's handling of certain network packets can let a local user crash the system or potentially gain elevated access.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the Linux kernel networking stack where a stale skb->sk pointer from bpf_sk_assign or UDP early demux is dereferenced via sock_pfree during multicast forwarding in ip_mr_input or ip6_mr_input after the referenced socket is destroyed.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or potentially escalate privileges, leading to system instability or compromise of hosts handling multicast traffic.

How an attack unfolds

An attacker with local access crafts or sends multicast packets that are not locally deliverable, causing the kernel to queue or forward the skb after the RCU section while retaining a prefetched socket reference without a guaranteed hold; once the socket is freed, a later skb release triggers the stale pointer use.

How to fix it

Apply the upstream kernel commit that orphans prefetched skbs before multicast forwarding paths; rebuild and deploy updated kernels to all affected systems.

How to confirm the fix worked

Verify kernel source includes the orphaning change before ip_mr_input/ip6_mr_input calls; test multicast forwarding scenarios with BPF and early-demux sockets to confirm no UAF occurs on skb free.

Typical attack path

  1. Obtain local code execution on a Linux host
  2. Prepare multicast traffic or use BPF/UDP paths to install a prefetched skb->sk without reference count
  3. Trigger non-local multicast forwarding path in IPv4 or IPv6
  4. Cause socket destruction while the original skb remains referenced
  5. Induce skb free to invoke sock_pfree on the dangling pointer

How to detect it

Review kernel logs for crashes or warnings referencing sock_pfree, skb orphans, or multicast routing functions; examine audit logs for unusual local BPF program loads or multicast socket activity around the time of any instability.

What your security team should do

  • Prioritize kernel updates on systems exposed to local untrusted users or containers
  • Monitor for kernel oops or panic reports involving sock_pfree or multicast code paths
  • Restrict local access and BPF privileges where multicast forwarding is enabled until patched

The record

In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an skb->sk association installed by bpf_sk_assign() so that local delivery can use the selected socket under RCU. Both address families can also prefetch a socket in UDP early demux. In both paths (BPF and UDP early demux) a reference is not guaranteed to be held on the socket. When a multicast packet is not locally deliverable, IPv6 hands the original skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the original skb when local delivery is not needed. Either path can put the skb on an unresolved multicast route queue or forward it after the receive-side RCU section ends. After the prefetched socket is destroyed, a later skb free invokes sock_pfree() and dereferences the stale skb->sk. Orphan the skb before each non-local multicast forwarding path. Local delivery retains the original skb; the existing skb_clone() calls provide multicast forwarding with a socket-free clone.

Affected packages

Ecosystem Package Introduced Fixed