CVE-2026-72321 Linux CVE debrief

Who should care

Linux kernel developers, maintainers, and users of Linux-based systems should be aware of this potential vulnerability and take steps to verify and apply the patch. Additionally, operators, platform administrators, and security teams may need to assess the impact on their systems and implement necessary mitigations. This may involve coordinating with Linux kernel developers and maintainers to ensure that the patch is applied and that any affected systems are updated. Furthermore, users of Linux-based systems should also be aware of this vulnerability and take steps to verify and apply the patch to their systems. This may involve monitoring for potential memory leaks in the IPv4 IGMP implementation and verifying the fix in the Linux kernel. Security teams may also need to review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and vulnerability management teams should also be aware of this vulnerability and take steps to identify and prioritize affected systems. Monitoring and detection teams should also review relevant monitoring, detection, and logs for exposed assets that need extra review. Finally, incident response teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. The CVSS score for this vulnerability is not provided, but the CVSS severity is likely to be Medium or High given the potential for a memory leak. The CVE record was published on 2026-08-15T06:22:05.103Z and has not been modified since then. The NVD detail for this vulnerability is available, and the Linux kernel developers and maintainers have provided a patch to address this issue. The patch involves using ip_ma_put(im) instead of refcount_dec(&im->refcnt) and deferring the put until after the spinlock is released. This patch should be applied to affected systems to prevent potential memory leaks. The Linux kernel developers and maintainers should also continue to monitor and review the IPv4 IGMP implementation to ensure that it is secure and reliable. The vulnerability was discovered in the Linux kernel's IPv4 IGMP implementation, and the issue occurs when a timer is deleted and not

Technical summary

The vulnerability occurs in the Linux kernel's IPv4 IGMP implementation, specifically in the igmp_mod_timer() and igmp_stop_timer() functions. A potential memory leak can occur when a timer is deleted and not re-armed or stopped, leading to a memory leak if the group im was concurrently removed from the list by ip_mc_dec_group(). The fix involves using ip_ma_put(im) instead of refcount_dec(&im->refcnt) and deferring the put until after the spinlock is released.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to the Linux kernel
• Monitor for potential memory leaks in the IPv4 IGMP implementation
• Verify the fix in the Linux kernel
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was discovered in the Linux kernel's IPv4 IGMP implementation. The issue occurs when a timer is deleted and not re-armed or stopped, leading to a potential memory leak. The fix involves using ip_ma_put(im) instead of refcount_dec(&im->refcnt) and deferring the put until after the spinlock is released. Evidence is limited; further verification is recommended.

Official resources