CVE-2026-64423

A flaw was found in the Linux kernel's Internet Group Management Protocol (IGMP) multicast group handling. When a network device is destroyed, its associated multicast groups are not properly removed from the device's hash table before their memory is reclaimed. This creates a race condition where a local attacker with low privileges could exploit this use-after-free vulnerability to cause system instability, escalate privileges, or potentially execute arbitrary code.

Red Hat has evaluated this issue as having a Moderate severity impact because triggering the underlying race condition requires tearing down a network device while concurrent multicast packet processing occurs, restricting the blast radius primarily to a local denial of service. Initiating network interface destruction generally demands administrative network capabilities, limiting exposure in default operating environments. Consequently, unauthorized remote execution or reliable privilege escalation is improbable under standard Red Hat Enterprise Linux deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.