{"id":"CVE-2026-89564","state":"PUBLISHED","title":"ip: orphan prefetched skbs before multicast forwarding","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nip: orphan prefetched skbs before multicast forwarding\n\nIPv4 and IPv6 input preserve an skb->sk association installed by\nbpf_sk_assign() so that local delivery can use the selected socket under\nRCU. Both address families can also prefetch a socket in UDP early demux.\nIn both paths (BPF and UDP early demux) a reference is not guaranteed to\nbe held on the socket.\n\nWhen a multicast packet is not locally deliverable, IPv6 hands the\noriginal skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the\noriginal skb when local delivery is not needed. Either path can put the\nskb on an unresolved multicast route queue or forward it after the\nreceive-side RCU section ends.\n\nAfter the prefetched socket is destroyed, a later skb free invokes\nsock_pfree() and dereferences the stale skb->sk. Orphan the skb before\neach non-local multicast forwarding path. Local delivery retains the\noriginal skb; the existing skb_clone() calls provide multicast forwarding\nwith a socket-free clone.","publishedAt":"2026-09-11T19:44:35.131Z","updatedAt":"2026-10-30T12:32:14.200Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","status":"affected","lessThan":"592b91f41d4f35e37c9e0be1c46a4c28437642cd","versionType":"git"},{"version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","status":"affected","lessThan":"882212d317a7c16ab70d20656f6b1c42abada9f6","versionType":"git"},{"version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","status":"affected","lessThan":"e62aef7d6a5b27569bf540bbe11a9482117ff588","versionType":"git"},{"version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","status":"affected","lessThan":"a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce","versionType":"git"},{"version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","status":"affected","lessThan":"f1281d4b99089fbaf0d3579bba62a814ebb4de4d","versionType":"git"},{"version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","status":"affected","lessThan":"e36ce6e78fe3fc3c071a26750783b7ba081ce10d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/ipmr.c","net/ipv6/ip6_input.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.7","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.111","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/ipmr.c","net/ipv6/ip6_input.c"]}],"references":["https://git.kernel.org/stable/c/592b91f41d4f35e37c9e0be1c46a4c28437642cd","https://git.kernel.org/stable/c/882212d317a7c16ab70d20656f6b1c42abada9f6","https://git.kernel.org/stable/c/e62aef7d6a5b27569bf540bbe11a9482117ff588","https://git.kernel.org/stable/c/a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce","https://git.kernel.org/stable/c/f1281d4b99089fbaf0d3579bba62a814ebb4de4d","https://git.kernel.org/stable/c/e36ce6e78fe3fc3c071a26750783b7ba081ce10d"],"weaknesses":[],"ingestedAt":"2026-10-30T12:50:04.827Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89564.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89564","state":"PUBLISHED","datePublished":"2026-09-11T19:44:35.131Z","dateUpdated":"2026-10-30T12:32:14.200Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.725Z"},"containers":{"cna":{"title":"ip: orphan prefetched skbs before multicast forwarding","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nip: orphan prefetched skbs before multicast forwarding\n\nIPv4 and IPv6 input preserve an skb->sk association installed by\nbpf_sk_assign() so that local delivery can use the selected socket under\nRCU. Both address families can also prefetch a socket in UDP early demux.\nIn both paths (BPF and UDP early demux) a reference is not guaranteed to\nbe held on the socket.\n\nWhen a multicast packet is not locally deliverable, IPv6 hands the\noriginal skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the\noriginal skb when local delivery is not needed. Either path can put the\nskb on an unresolved multicast route queue or forward it after the\nreceive-side RCU section ends.\n\nAfter the prefetched socket is destroyed, a later skb free invokes\nsock_pfree() and dereferences the stale skb->sk. Orphan the skb before\neach non-local multicast forwarding path. Local delivery retains the\noriginal skb; the existing skb_clone() calls provide multicast forwarding\nwith a socket-free clone."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","status":"affected","lessThan":"592b91f41d4f35e37c9e0be1c46a4c28437642cd","versionType":"git"},{"version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","status":"affected","lessThan":"882212d317a7c16ab70d20656f6b1c42abada9f6","versionType":"git"},{"version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","status":"affected","lessThan":"e62aef7d6a5b27569bf540bbe11a9482117ff588","versionType":"git"},{"version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","status":"affected","lessThan":"a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce","versionType":"git"},{"version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","status":"affected","lessThan":"f1281d4b99089fbaf0d3579bba62a814ebb4de4d","versionType":"git"},{"version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","status":"affected","lessThan":"e36ce6e78fe3fc3c071a26750783b7ba081ce10d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/ipmr.c","net/ipv6/ip6_input.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.7","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.111","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/ipmr.c","net/ipv6/ip6_input.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/592b91f41d4f35e37c9e0be1c46a4c28437642cd"},{"url":"https://git.kernel.org/stable/c/882212d317a7c16ab70d20656f6b1c42abada9f6"},{"url":"https://git.kernel.org/stable/c/e62aef7d6a5b27569bf540bbe11a9482117ff588"},{"url":"https://git.kernel.org/stable/c/a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce"},{"url":"https://git.kernel.org/stable/c/f1281d4b99089fbaf0d3579bba62a814ebb4de4d"},{"url":"https://git.kernel.org/stable/c/e36ce6e78fe3fc3c071a26750783b7ba081ce10d"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The UAF requires the attacker to attach a no-ref skb->sk (UDP early demux or bpf_sk_assign) and destroy that socket while the skb sits on the mroute unresolved queue; a remote multicast datagram does not prefetch onto non-local ip_mr_input/ip6_mr_input (mcast early demux needs membership, which clones; ip_forward drops skb->sk).\nAC:L - The attacker owns every step: enable mroute, bind/connect a UDP socket or attach TC bpf_sk_assign, inject a non-local multicast skb so ipmr_cache_unresolved() queues it for 10s, then close the socket and wait for kfree_skb; no uncontrolled race or memory layout is required.\nPR:L - MRT_INIT needs a raw IGMP/ICMPv6 socket (ns_capable CAP_NET_RAW) and VIFs/TC bpf_sk_assign need CAP_NET_ADMIN in the netns; an unprivileged user obtains both via unshare -Urn and never needs real init-namespace root.\nUI:N - The attacker performs the entire setup, packet injection, and socket close in their own user/net namespace; no other user must mount, open a file, or otherwise interact.\nS:U - The sock_pfree use-after-free corrupts kernel memory in the same host networking authority and does not cross a VM, IOMMU, or other security boundary.\nC:H - sock_pfree() dereferences the stale skb->sk after the SOCK_RCU_FREE socket is destroyed; that UAF on a struct sock can be reclaimed with attacker-controlled objects, yielding an arbitrary read primitive.\nI:H - If the reused object looks refcounted, sock_pfree() calls sock_gen_put() and refcount_dec_and_test() on the freed sock, giving a UAF write/control-flow hijack primitive via heap spray.\nA:H - Freeing the queued skb after socket destruction oopses in sock_pfree() even without a full exploit, so the bug is a reliable kernel crash as well as a UAF."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:32:14.200Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.12.111"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.18.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-89564","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T19:24:14.849445Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:26:44.346Z"}}]}}}