GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89564 (GCVE-0-2026-89564)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:44 – Updated: 2026-09-13 06:31
VLAI
Title
ip: orphan prefetched skbs before multicast forwarding
Summary
In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an skb->sk association installed by bpf_sk_assign() so that local delivery can use the selected socket under RCU. Both address families can also prefetch a socket in UDP early demux. In both paths (BPF and UDP early demux) a reference is not guaranteed to be held on the socket. When a multicast packet is not locally deliverable, IPv6 hands the original skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the original skb when local delivery is not needed. Either path can put the skb on an unresolved multicast route queue or forward it after the receive-side RCU section ends. After the prefetched socket is destroyed, a later skb free invokes sock_pfree() and dereferences the stale skb->sk. Orphan the skb before each non-local multicast forwarding path. Local delivery retains the original skb; the existing skb_clone() calls provide multicast forwarding with a socket-free clone.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 , < a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce (git)
Affected: cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 , < f1281d4b99089fbaf0d3579bba62a814ebb4de4d (git)
Affected: cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 , < e36ce6e78fe3fc3c071a26750783b7ba081ce10d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ipmr.c",
            "net/ipv6/ip6_input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce",
              "status": "affected",
              "version": "cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449",
              "versionType": "git"
            },
            {
              "lessThan": "f1281d4b99089fbaf0d3579bba62a814ebb4de4d",
              "status": "affected",
              "version": "cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449",
              "versionType": "git"
            },
            {
              "lessThan": "e36ce6e78fe3fc3c071a26750783b7ba081ce10d",
              "status": "affected",
              "version": "cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ipmr.c",
            "net/ipv6/ip6_input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip: orphan prefetched skbs before multicast forwarding\n\nIPv4 and IPv6 input preserve an skb-\u003esk association installed by\nbpf_sk_assign() so that local delivery can use the selected socket under\nRCU. Both address families can also prefetch a socket in UDP early demux.\nIn both paths (BPF and UDP early demux) a reference is not guaranteed to\nbe held on the socket.\n\nWhen a multicast packet is not locally deliverable, IPv6 hands the\noriginal skb to ip6_mr_input(). IPv4\u0027s ip_mr_input() similarly keeps the\noriginal skb when local delivery is not needed. Either path can put the\nskb on an unresolved multicast route queue or forward it after the\nreceive-side RCU section ends.\n\nAfter the prefetched socket is destroyed, a later skb free invokes\nsock_pfree() and dereferences the stale skb-\u003esk. Orphan the skb before\neach non-local multicast forwarding path. Local delivery retains the\noriginal skb; the existing skb_clone() calls provide multicast forwarding\nwith a socket-free clone."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF requires the attacker to attach a no-ref skb-\u003esk (UDP early demux or bpf_sk_assign) and destroy that socket while the skb sits on the mroute unresolved queue; a remote multicast datagram does not prefetch onto non-local ip_mr_input/ip6_mr_input (mcast early demux needs membership, which clones; ip_forward drops skb-\u003esk).\nAC:L - The attacker owns every step: enable mroute, bind/connect a UDP socket or attach TC bpf_sk_assign, inject a non-local multicast skb so ipmr_cache_unresolved() queues it for 10s, then close the socket and wait for kfree_skb; no uncontrolled race or memory layout is required.\nPR:L - MRT_INIT needs a raw IGMP/ICMPv6 socket (ns_capable CAP_NET_RAW) and VIFs/TC bpf_sk_assign need CAP_NET_ADMIN in the netns; an unprivileged user obtains both via unshare -Urn and never needs real init-namespace root.\nUI:N - The attacker performs the entire setup, packet injection, and socket close in their own user/net namespace; no other user must mount, open a file, or otherwise interact.\nS:U - The sock_pfree use-after-free corrupts kernel memory in the same host networking authority and does not cross a VM, IOMMU, or other security boundary.\nC:H - sock_pfree() dereferences the stale skb-\u003esk after the SOCK_RCU_FREE socket is destroyed; that UAF on a struct sock can be reclaimed with attacker-controlled objects, yielding an arbitrary read primitive.\nI:H - If the reused object looks refcounted, sock_pfree() calls sock_gen_put() and refcount_dec_and_test() on the freed sock, giving a UAF write/control-flow hijack primitive via heap spray.\nA:H - Freeing the queued skb after socket destruction oopses in sock_pfree() even without a full exploit, so the bug is a reliable kernel crash as well as a UAF."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:31:05.172Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1281d4b99089fbaf0d3579bba62a814ebb4de4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e36ce6e78fe3fc3c071a26750783b7ba081ce10d"
        }
      ],
      "title": "ip: orphan prefetched skbs before multicast forwarding",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89564",
    "datePublished": "2026-09-11T19:44:35.131Z",
    "dateReserved": "2026-09-11T19:38:34.725Z",
    "dateUpdated": "2026-09-13T06:31:05.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89564",
      "date": "2026-09-16",
      "epss": "0.00136",
      "percentile": "0.03432"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:58:10.000Z",
      "cve": "CVE-2026-89564",
      "id": "msrc_CVE-2026-89564",
      "initial_release_date": "2026-09-13T01:11:04.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ip: orphan prefetched skbs before multicast forwarding",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89564.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89564\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:40.313\",\"lastModified\":\"2026-09-13T07:17:22.713\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nip: orphan prefetched skbs before multicast forwarding\\n\\nIPv4 and IPv6 input preserve an skb-\u003esk association installed by\\nbpf_sk_assign() so that local delivery can use the selected socket under\\nRCU. Both address families can also prefetch a socket in UDP early demux.\\nIn both paths (BPF and UDP early demux) a reference is not guaranteed to\\nbe held on the socket.\\n\\nWhen a multicast packet is not locally deliverable, IPv6 hands the\\noriginal skb to ip6_mr_input(). IPv4\u0027s ip_mr_input() similarly keeps the\\noriginal skb when local delivery is not needed. Either path can put the\\nskb on an unresolved multicast route queue or forward it after the\\nreceive-side RCU section ends.\\n\\nAfter the prefetched socket is destroyed, a later skb free invokes\\nsock_pfree() and dereferences the stale skb-\u003esk. Orphan the skb before\\neach non-local multicast forwarding path. Local delivery retains the\\noriginal skb; the existing skb_clone() calls provide multicast forwarding\\nwith a socket-free clone.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/ipmr.c\",\"net/ipv6/ip6_input.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449\",\"lessThan\":\"a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449\",\"lessThan\":\"f1281d4b99089fbaf0d3579bba62a814ebb4de4d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449\",\"lessThan\":\"e36ce6e78fe3fc3c071a26750783b7ba081ce10d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/ipmr.c\",\"net/ipv6/ip6_input.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e36ce6e78fe3fc3c071a26750783b7ba081ce10d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f1281d4b99089fbaf0d3579bba62a814ebb4de4d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-16T11:48:42+00:00",
      "cve": "CVE-2026-89564",
      "id": "CVE-2026-89564",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "234",
      "product_status:known_not_affected": "28",
      "product_status:under_investigation": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ip: orphan prefetched skbs before multicast forwarding",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89564.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.