SB2026081649 - Resource management error in Linux kernel ipv4

Description

This security bulletin contains information about 1 vulnerability.

1) Resource management error (CVE-ID: CVE-2026-72321)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in igmp_mod_timer() and igmp_stop_timer() when deleting or stopping IGMP timers during concurrent multicast group removal. A local user can trigger IGMP processing that reaches these code paths to cause a denial of service.

The issue can occur when the affected multicast list entry is accessed from an RCU reader path while the group is concurrently removed from the list.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36
• https://git.kernel.org/stable/c/95128dc74425ec19ed4f2077ccc651e791ff4b75
• https://git.kernel.org/stable/c/f60ec3058a85447008b88b762c859d336163acb3