CVE-2026-89564

A flaw was found in the Linux kernel's IP multicast forwarding. When a prefetched socket is destroyed, a subsequent operation to free a network packet (skb) can attempt to access the already freed socket memory. This use-after-free vulnerability can be triggered by a remote attacker sending specially crafted multicast packets. A successful exploit could lead to a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Important because successful exploitation can cause a kernel crash, resulting in host unavailability. The risk primarily manifests in environments configured to forward multicast traffic while utilizing UDP early demux or BPF socket redirection. Because the kernel dereferences stale socket structures during packet release operations, an attacker sending tailored multicast traffic can crash the system without requiring elevated privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.