CVE-2026-72323

A flaw was found in the Linux kernel. A race condition exists between network device teardown and Internet Group Management Protocol (IGMP) query processing. This can lead to a Use-After-Free (UAF) vulnerability in the igmp_gq_start_timer() function, which could allow an attacker to trigger a kernel panic and cause a Denial of Service (DoS).

This vulnerability is evaluated as an Important severity risk because triggering the underlying memory corruption can result in an immediate operating system crash and denial of service across the entire host. In default Red Hat Enterprise Linux deployments, IPv4 multicast query processing is enabled automatically for active interfaces, exposing systems to this flaw when interfaces are destroyed or unconfigured while handling network traffic. Although successful exploitation requires specific synchronization between network device teardown routines and incoming packets, the potential blast radius affects system availability without requiring administrative authentication from the network.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.