VulnerabilityPublished 13 Aug 2026

ZDI-26-570: Linux Kernel IGMP Subsystem Race Condition Local Privilege Escalation Vulnerability

Source Zero Day Initiative

Severity

High

Rated High by Zero Day Initiative

Data as of 21 Aug 2026, 17:34 UTC

What to do

AI-suggested

Linux has issued an official update to correct this vulnerability. Users and administrators should apply the provided patch from the Linux kernel repository to remediate this issue. No additional mitigation is required beyond applying the official fix.

Description

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5.

Impact

Local attackers with high-privileged code execution capabilities can exploit this race condition to escalate privileges and execute arbitrary code in kernel context, potentially compromising system integrity and control.

Summary

This vulnerability in the Linux Kernel IGMP subsystem is a race condition caused by improper locking when handling general-query timers. It allows local attackers who already have the ability to execute high-privileged code to escalate their privileges and execute arbitrary code within the kernel context. The vulnerability has a CVSS score of 7.5, indicating high severity. Linux has released a patch to fix this issue, as referenced in the official commit at https://github.com/torvalds/linux/commit/7b19c0f81ed1fdaec6bc522569be367199a9edf3.

References

zerodayinitiative.com/advisories/ZDI-26-570/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 13 Aug 2026, 20:48 UTC

References

Community reviews

Related threats