CVE-2026-89564

ip: orphan prefetched skbs before multicast forwarding

State: Published
Severity: 7.8 High
Published: Sep 11, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ip: orphan prefetched skbs before multicast forwarding

IPv4 and IPv6 input preserve an skb->sk association installed by bpf_sk_assign() so that local delivery can use the selected socket under RCU. Both address families can also prefetch a socket in UDP early demux. In both paths (BPF and UDP early demux) a reference is not guaranteed to be held on the socket.

When a multicast packet is not locally deliverable, IPv6 hands the original skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the original skb when local delivery is not needed. Either path can put the skb on an unresolved multicast route queue or forward it after the receive-side RCU section ends.

After the prefetched socket is destroyed, a later skb free invokes sock_pfree() and dereferences the stale skb->sk. Orphan the skb before each non-local multicast forwarding path. Local delivery retains the original skb; the existing skb_clone() calls provide multicast forwarding with a socket-free clone.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 to before 592b91f41d4f35e37c9e0be1c46a4c28437642cdAffected cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 to before 882212d317a7c16ab70d20656f6b1c42abada9f6Affected cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 to before e62aef7d6a5b27569bf540bbe11a9482117ff588Affected cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 to before a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ceAffected cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 to before f1281d4b99089fbaf0d3579bba62a814ebb4de4dAffected cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 to before e36ce6e78fe3fc3c071a26750783b7ba081ce10dAffected
LinuxLinux	5.7Affected before 5.7Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 to before 592b91f41d4f35e37c9e0be1c46a4c28437642cdAffected
cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 to before 882212d317a7c16ab70d20656f6b1c42abada9f6Affected
cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 to before e62aef7d6a5b27569bf540bbe11a9482117ff588Affected
cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 to before a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ceAffected
cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 to before f1281d4b99089fbaf0d3579bba62a814ebb4de4dAffected
cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 to before e36ce6e78fe3fc3c071a26750783b7ba081ce10dAffected

LinuxLinux

5.7Affected
before 5.7Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.