CVE-2026-72322 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: Fix potential UAF in MLD delayed work
A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work.
During device destruction, the primary reference to inet6_dev is dropped, which can drop its refcount to 0. The actual freeing of inet6_dev memory is deferred via RCU.
Concurrently, the packet receive path runs under RCU read lock and obtains the inet6_dev pointer. Because the memory is RCU-protected, CPU-0 can safely dereference inet6_dev even if its refcount has hit 0.
However, if CPU-0 calls igmp6_event_query() and schedules delayed work, it attempts to acquire a reference using in6_dev_hold(). This increments the refcount from 0 to 1, triggering a "refcount_t: addition on 0" warning. Since the inet6_dev memory is still scheduled to be freed after the RCU grace period, the device is freed while the work is still scheduled. When the work runs, it accesses the freed memory, causing a kernel panic.
Fix this by using refcount_inc_not_zero() (via a new helper in6_dev_hold_safe()) to prevent acquiring a reference if the device is already being destroyed. If the refcount is 0, we do not schedule the work.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical use-after-free condition within the Linux kernel's IPv6 multicast listener discovery implementation. This issue specifically affects the handling of Multicast Listener Discovery (MLD) delayed work processing during network device teardown operations. The flaw arises from improper synchronization between the device destruction lifecycle and concurrent packet processing paths that can lead to kernel memory corruption and system instability.
The technical root cause involves a race condition between two distinct execution contexts within the kernel's networking subsystem. During device teardown, the primary reference to the inet6_dev structure is dropped, reducing its reference count to zero while the actual memory deallocation is deferred through RCU (Read-Copy-Update) mechanisms. However, the packet receive path operates under RCU read lock protection and may still access the inet6_dev pointer even when its reference count has reached zero, creating a dangerous temporal window for memory access violations.
When a CPU thread executes igmp6_event_query() function and schedules delayed work, it attempts to acquire a reference using in6_dev_hold(), which increments the reference count from zero to one. This operation triggers a kernel warning about "refcount_t: addition on 0" indicating that the system is attempting to increment an already-zero reference counter. The critical flaw occurs because the delayed work scheduling process does not properly account for the device destruction state, allowing work items to be scheduled against memory that will soon be freed.
The operational impact of this vulnerability extends beyond simple kernel panics to potentially enable privilege escalation or denial-of-service conditions within networked systems. Attackers could exploit this race condition by initiating specific network traffic patterns during device teardown operations, leading to unpredictable system behavior and potential system crashes. The vulnerability affects systems running Linux kernels that implement IPv6 multicast functionality, particularly those handling dynamic network device configurations.
This vulnerability maps directly to CWE-415: Double Free and CWE-416: Use After Free categories within the Common Weakness Enumeration framework, while also aligning with ATT&CK technique T1059.007 for system execution and T1499.004 for network denial of service. The fix implements a defensive programming approach by introducing in6_dev_hold_safe() helper function that uses refcount_inc_not_zero() semantics to prevent reference acquisition when the device is already in the process of being destroyed. This solution prevents scheduling delayed work when the reference count is zero, ensuring that memory access violations cannot occur during the RCU grace period.
The mitigation strategy requires kernel-level patches that modify the reference counting logic in MLD processing code to properly handle concurrent device destruction scenarios. The fix demonstrates proper defensive programming practices by implementing atomic reference counting operations that prevent invalid memory access patterns. This approach aligns with Linux kernel security best practices for handling RCU-protected data structures and ensures that delayed work items are only scheduled when the underlying device structure remains valid throughout the work execution lifecycle.