CVE-2026-89564

The Linux kernel's IPv4 and IPv6 input paths can leave a pointer to a socket in an skb's skb->sk field, installed either by a bpf_sk_assign() BPF program or by UDP early demux prefetch, without guaranteeing a reference is held on that socket. If a multicast packet is not locally deliverable, the original skb is handed to ip_mr_input() or ip6_mr_input(), where it may sit on an unresolved multicast route queue or be forwarded after the receive-side RCU section has ended. If the prefetched socket is destroyed in the meantime, the skb's eventual free path calls sock_pfree() and dereferences the stale socket pointer, a use-after-free rated CVSS 7.8 (local vector, low privileges, high confidentiality/integrity/availability impact). A local attacker with low privileges who can influence multicast traffic and socket lifetimes on an affected host could plausibly crash the kernel or escalate privileges through memory corruption. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and there is no evidence of exploitation in the wild; the fix orphans the skb before non-local multicast forwarding so forwarded clones carry no socket reference.

What to do: Apply your distribution's kernel update containing the upstream fix (the patch that orphans skbs before non-local multicast forwarding) and reboot into the patched kernel, since no safe runtime workaround exists for the kernel code itself. Check whether hosts actually run multicast routing (mroute/PIM daemons like pimd, FRR's pimd, or igmp proxies) or TC BPF programs using bpf_sk_assign, and disable multicast forwarding where it is not needed. As defense-in-depth for this and other local BPF/vector attacks, set kernel.unprivileged_bpf_disabled=1, and monitor for oopses or crashes referencing sock_pfree, ip_mr_input, or ip6_mr_input.