CVE-2026-53275

A flaw was found in the Linux kernel's IPv6 multicast (mcast) component. When processing Multicast Listener Discovery (MLD) queries, a pointer to the multicast group address is not correctly reloaded after certain packet manipulations. This can lead to a use-after-free vulnerability, potentially allowing an attacker to cause a denial of service or achieve arbitrary code execution.

IPv6 MLD query processing can dereference a stale multicast group address pointer after pskb_may_pull reallocates the skb header, resulting in a use-after-free read in __mld_query_work. An adjacent network attacker can potentially trigger this with a crafted MLD query because MLD is an ICMPv6 link-local control protocol and is not normally routable across the Internet. For the CVSS the PR:N is used because no credentials or local account on the victim are required when the attacker is on the same L2 segment. AC:H is used because reliable triggering depends on skb layout and header reallocation conditions. Impact is at least denial of service via kernel crash. The paranoid score keeps limited confidentiality and integrity impact because this is a real UAF read in networking code, but there is no clear arbitrary write primitive in the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.