External risk intelligence

Linux Kernel IGMP Use-After-Free Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72323

This vulnerability exists within the Linux kernel's internal network stack implementation related to IGMP timer management. It is a low-level race condition requiring specific, complex local conditions involving device teardown and kernel timing, rather than representing a remotely reachable service, interface, or network-exposed application.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This Linux kernel vulnerability involves a race condition in how network devices are managed and how IGMP (Internet Group Management Protocol) queries are processed. If triggered, it could lead to a kernel panic, impacting system stability. The main concern is confirming relevance and exposure within the Linux kernel's network stack.

A timing flaw can crash the system.
It affects core Linux network functions.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a race condition within the Linux kernel's IGMP (Internet Group Management Protocol) handling. This occurs when a network device is being removed at the same time the kernel is processing an IGMP query. If the timing is just right, a specific timer within the IGMP module can be re-armed after its associated device memory has been marked for deletion but before it's actually freed. This leads to the timer attempting to access freed memory, causing a system crash.

Entry condition: Network device removal and IGMP query overlap.
Trigger point: Re-arming an IGMP timer on freed memory.
Resulting risk: Kernel panic and system instability.

Live Threat

Current exploitation, exposure, and threat context

A race condition in the Linux kernel's IGMP handling could lead to a kernel panic when network devices are being destroyed. This occurs because a timer event might try to access memory that has already been freed, causing the system to crash under specific, complex timing conditions.

Kernel stability and network operations.
Race condition during device teardown.
System crashes, potential denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Linux kernel's IGMP handling requires immediate attention from teams managing Linux systems. The first practical step is to identify all systems running the affected kernel version, determine their network exposure and business criticality, and confirm the accountable owner for each. Remediation planning should then proceed based on the identified risk.

Linux infrastructure owners should manage this issue.
Verify affected kernel reachability and criticality first.
Plan remediation considering system impact and uptime.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel IGMP component?

The Linux kernel is the foundational software that manages hardware resources for an operating system. Within it, the IGMP (Internet Group Management Protocol) component handles how devices on a local network announce which multicast data streams they want to receive. It is a core part of the networking stack that ensures efficient communication between devices.

What happens in CVE-2026-72323?

This vulnerability is a race condition involving memory management. It occurs when a network device is being removed while the kernel is simultaneously processing an incoming IGMP query. Because of the timing, the kernel may attempt to restart a timer for a device that is already marked for deletion. This results in a 'Use-After-Free' error, where the system tries to use memory that is no longer valid, causing a kernel panic.

What triggers this kernel vulnerability?

The vulnerability requires the specific, simultaneous overlap of two events: the teardown or removal of a network device and the processing of an incoming IGMP query. It is not triggered by standard, stable network traffic or typical administrative commands on a running interface. The issue is strictly tied to this precise race condition during the device's destruction process.

Is my system at risk for CVE-2026-72323?

According to Halo Surface Signal, this vulnerability is very unlikely to be a concern for most users. Because the flaw exists deep within the kernel's internal network stack and requires highly specific timing during device teardown, it does not function like an externally reachable network service. It is not a common entry point for remote attackers.

How do I respond to this Linux kernel issue?

Your first step should be to identify all Linux infrastructure in your environment that may be running an affected kernel version. Once identified, evaluate the systems based on their business criticality and overall role. Since this involves a core kernel function, consult your Linux distribution vendor's security guidance and prepare to apply authorized kernel updates as part of your standard maintenance lifecycle.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.