{"api_version":"1","generated_at":"2026-09-13T03:15:04+00:00","cve":"CVE-2026-89564","urls":{"html":"https://cve.report/CVE-2026-89564","api":"https://cve.report/api/cve/CVE-2026-89564.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89564","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89564"},"summary":{"title":"ip: orphan prefetched skbs before multicast forwarding","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nip: orphan prefetched skbs before multicast forwarding\n\nIPv4 and IPv6 input preserve an skb->sk association installed by\nbpf_sk_assign() so that local delivery can use the selected socket under\nRCU. Both address families can also prefetch a socket in UDP early demux.\nIn both paths (BPF and UDP early demux) a reference is not guaranteed to\nbe held on the socket.\n\nWhen a multicast packet is not locally deliverable, IPv6 hands the\noriginal skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the\noriginal skb when local delivery is not needed. Either path can put the\nskb on an unresolved multicast route queue or forward it after the\nreceive-side RCU section ends.\n\nAfter the prefetched socket is destroyed, a later skb free invokes\nsock_pfree() and dereferences the stale skb->sk. Orphan the skb before\neach non-local multicast forwarding path. Local delivery retains the\noriginal skb; the existing skb_clone() calls provide multicast forwarding\nwith a socket-free clone.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-11 20:19:40","updated_at":"2026-09-11 20:19:40"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/e36ce6e78fe3fc3c071a26750783b7ba081ce10d","name":"https://git.kernel.org/stable/c/e36ce6e78fe3fc3c071a26750783b7ba081ce10d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f1281d4b99089fbaf0d3579bba62a814ebb4de4d","name":"https://git.kernel.org/stable/c/f1281d4b99089fbaf0d3579bba62a814ebb4de4d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce","name":"https://git.kernel.org/stable/c/a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89564","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89564","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 f1281d4b99089fbaf0d3579bba62a814ebb4de4d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 e36ce6e78fe3fc3c071a26750783b7ba081ce10d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.7","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.7 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.50 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.4 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"89564","cve":"CVE-2026-89564","epss":"0.001730000","percentile":"0.069440000","score_date":"2026-09-12","updated_at":"2026-09-13 00:08:17"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/ipmr.c","net/ipv6/ip6_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce","status":"affected","version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","versionType":"git"},{"lessThan":"f1281d4b99089fbaf0d3579bba62a814ebb4de4d","status":"affected","version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","versionType":"git"},{"lessThan":"e36ce6e78fe3fc3c071a26750783b7ba081ce10d","status":"affected","version":"cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/ipmr.c","net/ipv6/ip6_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.50","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.50","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.4","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"5.7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nip: orphan prefetched skbs before multicast forwarding\n\nIPv4 and IPv6 input preserve an skb->sk association installed by\nbpf_sk_assign() so that local delivery can use the selected socket under\nRCU. Both address families can also prefetch a socket in UDP early demux.\nIn both paths (BPF and UDP early demux) a reference is not guaranteed to\nbe held on the socket.\n\nWhen a multicast packet is not locally deliverable, IPv6 hands the\noriginal skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the\noriginal skb when local delivery is not needed. Either path can put the\nskb on an unresolved multicast route queue or forward it after the\nreceive-side RCU section ends.\n\nAfter the prefetched socket is destroyed, a later skb free invokes\nsock_pfree() and dereferences the stale skb->sk. Orphan the skb before\neach non-local multicast forwarding path. Local delivery retains the\noriginal skb; the existing skb_clone() calls provide multicast forwarding\nwith a socket-free clone."}],"providerMetadata":{"dateUpdated":"2026-09-11T19:44:35.131Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/a8af6fbac895f057c4b8ff8a2e3fb4c5827fe4ce"},{"url":"https://git.kernel.org/stable/c/f1281d4b99089fbaf0d3579bba62a814ebb4de4d"},{"url":"https://git.kernel.org/stable/c/e36ce6e78fe3fc3c071a26750783b7ba081ce10d"}],"title":"ip: orphan prefetched skbs before multicast forwarding","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-89564","datePublished":"2026-09-11T19:44:35.131Z","dateReserved":"2026-09-11T19:38:34.725Z","dateUpdated":"2026-09-11T19:44:35.131Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-11 20:19:40","lastModifiedDate":"2026-09-11 20:19:40","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89564","Ordinal":"1","Title":"ip: orphan prefetched skbs before multicast forwarding","CVE":"CVE-2026-89564","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89564","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nip: orphan prefetched skbs before multicast forwarding\n\nIPv4 and IPv6 input preserve an skb->sk association installed by\nbpf_sk_assign() so that local delivery can use the selected socket under\nRCU. Both address families can also prefetch a socket in UDP early demux.\nIn both paths (BPF and UDP early demux) a reference is not guaranteed to\nbe held on the socket.\n\nWhen a multicast packet is not locally deliverable, IPv6 hands the\noriginal skb to ip6_mr_input(). IPv4's ip_mr_input() similarly keeps the\noriginal skb when local delivery is not needed. Either path can put the\nskb on an unresolved multicast route queue or forward it after the\nreceive-side RCU section ends.\n\nAfter the prefetched socket is destroyed, a later skb free invokes\nsock_pfree() and dereferences the stale skb->sk. Orphan the skb before\neach non-local multicast forwarding path. Local delivery retains the\noriginal skb; the existing skb_clone() calls provide multicast forwarding\nwith a socket-free clone.","Type":"Description","Title":"ip: orphan prefetched skbs before multicast forwarding"}]}}}