CVE-2026-72323

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The bug is reached from igmp_rcv(), registered as the IPPROTO_IGMP handler and invoked via ip_rcv → ip_local_deliver → ip_protocol_deliver_rcu() on received IPv4 packets; per kernel guidance, net/ stack flaws triggered by inbound packets are scored Network even when practical reachability is typically same-subnet.

AC:LAttack complexity, low

An attacker controls both race sides: flooding IGMP general membership queries while concurrently deleting/tearing down the target netdev (e.g., veth in a user/net namespace, container CNI teardown, or parallel RTNETLINK unregister), and can retry until the timer is re-armed after ip_mc_down() during inetdev_destroy().

PR:NPrivileges required, none

IGMP query processing has no authentication or capability checks on the receive path; any host that can deliver IPPROTO_IGMP packets to the interface can trigger igmp_heard_query() → igmp_gq_start_timer(), and concurrent interface destruction is normal system/orchestrator activity rather than attacker privilege on the victim.

UI:NUser interaction, none

Exploitation requires only attacker-sent IGMP packets timed against interface teardown; no victim must open files, click links, mount filesystems, or take any deliberate action beyond routine network interface lifecycle events.

S:UScope, unchanged

The use-after-free corrupts kernel heap memory within the same host kernel security authority; it is a standard in-kernel memory corruption issue, not a VM escape, IOMMU bypass, or other cross-boundary scope change.

C:HConfidentiality impact, high

This is a use-after-free of struct in_device: igmp_gq_timer_expire() dereferences freed memory and calls igmpv3_send_report(), enabling disclosure of reallocated slab contents and arbitrary kernel memory read primitives via heap grooming.

I:HIntegrity impact, high

The UAF arms mr_gq_timer on a freed in_device and the expiry handler writes through dangling pointers (mr_gq_running, igmpv3_send_report paths), providing attacker-influenced heap corruption that can be developed into arbitrary kernel write and privilege escalation.

A:HAvailability impact, high

The fix commit states the timer callback accesses freed in_device memory and causes kernel panic; UAF on a timer-armed netdev structure is a reliable oops/panic and repeatable DoS, and can be retriggered by continued IGMP query flooding during interface churn.