Use-after-free in Linux kernel's ipv4: igmp component

CVE-2023-6932

What is CVE-2023-6932?

A use-after-free vulnerability has been identified in the IGMP component of the Linux kernel, which could be exploited for local privilege escalation. This flaw allows attackers to trigger a race condition that results in a timer being erroneously registered on an RCU read locked object that is subsequently freed by another thread, potentially leading to unauthorized access or control of the affected system. It is highly recommended to update to versions past commit e2b706c691905fe78468c361aaabc719d0a496f1 to mitigate this risk.

References