CVE-2026-64423 describes a use-after-free vulnerability in the Linux kernel's IPv4 IGMP implementation. When a network device is destroyed under RTNL, the function ip_mc_destroy_dev() iterates through multicast memberships and schedules them for RCU reclamation but fails to unlink them from the device's multicast hash table (mc_hash). Because the device remains published until after ip_mc_destroy_dev() completes, concurrent RCU readers can access multicast groups after their reference counts are decremented. If the RCU callback frees the group while a reader accesses it, a use-after-free occurs. The vulnerability is fixed by unlinking the multicast group from mc_hash using ip_mc_hash_remove() before scheduling reclamation.

This vulnerability can lead to use-after-free conditions in kernel memory, which may cause kernel crashes or undefined behavior. While no specific exploit in the wild is known, such memory corruption issues can potentially be leveraged for privilege escalation or denial of service.

A fix for this vulnerability has been implemented in the Linux kernel by unlinking multicast groups from the hash table before scheduling them for reclamation. Users should apply the official Linux kernel updates that include this fix. Since no patch links or vendor advisory are provided here, check the official Linux kernel repositories or vendor advisories for the relevant fixed kernel versions and update accordingly.