CVE-2026-89564

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ip: orphan prefetched skbs before multicast forwarding

IPv4 and IPv6 input preserve an skb->sk association installed by

bpf_sk_assign() so that local delivery can use the selected socket under

RCU. Both address families can also prefetch a socket in UDP early demux.

In both paths (BPF and UDP early demux) a reference is not guaranteed to

be held on the socket.

When a multicast packet is not locally deliverable, IPv6 hands the

original skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the

original skb when local delivery is not needed. Either path can put the

skb on an unresolved multicast route queue or forward it after the

receive-side RCU section ends.

After the prefetched socket is destroyed, a later skb free invokes

sock_pfree() and dereferences the stale skb->sk. Orphan the skb before

each non-local multicast forwarding path. Local delivery retains the

original skb; the existing skb_clone() calls pro

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References