In the Linux kernel, the following vulnerability has been resolved:
ipv4: igmp: Fix potential memory leaks in igmpmodtimer() and igmpstoptimer()
When a timer is deleted and not re-armed in igmpmodtimer(), or stopped in igmpstoptimer(), the code currently decrements the reference counter of the multicast list entry @im using refcount_dec(&im->refcnt).
However, both functions can be called from the RCU reader path: - igmpmodtimer() via igmpheardquery() -> foreachpmcrcu() - igmpstoptimer() via igmprcv() -> igmpheardreport()
If the group im was concurrently removed from the list by ipmcdec_group(), its reference count might have already been decremented to 1.
In this case, timerdelete() succeeds, and refcountdec() decrements the refcount from 1 to 0. Since refcountdec() does not free the object when it hits 0 (unlike ipma_put()), the im structure is leaked.
Fix this by using ipmaput(im) instead of refcount_dec(&im->refcnt), and deferring the put until after the spinlock is released.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72321.json",
"cna_assigner": "Linux"
}