In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() When a timer is deleted and not re-armed in igmp_mod_timer(), or stopped in igmp_stop_timer(), the code currently decrements the reference counter of the multicast list entry @im using refcount_dec(&im->refcnt). However, both functions can be called from the RCU reader path: - igmp_mod_timer() via igmp_heard_query() -> for_each_pmc_rcu() - igmp_stop_timer() via igmp_rcv() -> igmp_heard_report() If the group im was concurrently removed from the list by ip_mc_dec_group(), its reference count might have already been decremented to 1. In this case, timer_delete() succeeds, and refcount_dec() decrements the refcount from 1 to 0. Since refcount_dec() does not free the object when it hits 0 (unlike ip_ma_put()), the im structure is leaked. Fix this by using ip_ma_put(im) instead of refcount_dec(&im->refcnt), and deferring the put until after the spinlock is released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks
    in igmp_mod_timer() and igmp_stop_timer() When a timer is deleted and not re-armed in igmp_mod_timer(), or
    stopped in igmp_stop_timer(), the code currently decrements the reference counter of the multicast list
    entry @im using refcount_dec(&im->refcnt). However, both functions can be called from the RCU reader path:
    - igmp_mod_timer() via igmp_heard_query() -> for_each_pmc_rcu() - igmp_stop_timer() via igmp_rcv() ->
    igmp_heard_report() If the group im was concurrently removed from the list by ip_mc_dec_group(), its
    reference count might have already been decremented to 1. In this case, timer_delete() succeeds, and
    refcount_dec() decrements the refcount from 1 to 0. Since refcount_dec() does not free the object when it
    hits 0 (unlike ip_ma_put()), the im structure is leaked. Fix this by using ip_ma_put(im) instead of
    refcount_dec(&im->refcnt), and deferring the put until after the spinlock is released. (CVE-2026-72321)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() When a timer is deleted     and not re-armed in igmp_mod_timer(), or stopped in igmp_stop_timer(), the code currently decrements the     reference counter of the multicast list entry @im using refcount_dec(&im->refcnt). However, both functions     can be called from the RCU reader path: - igmp_mod_timer() via igmp_heard_query() -> for_each_pmc_rcu() -     igmp_stop_timer() via igmp_rcv() -> igmp_heard_report() If the group im was concurrently removed from the     list by ip_mc_dec_group(), its reference count might have already been decremented to 1. In this case,     timer_delete() succeeds, and refcount_dec() decrements the refcount from 1 to 0. Since refcount_dec() does     not free the object when it hits 0 (unlike ip_ma_put()), the im structure is leaked. Fix this by using     ip_ma_put(im) instead of refcount_dec(&im->refcnt), and deferring the put until after the spinlock is     released. (CVE-2026-72321)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
470505	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Cloud Security	Google COS Security Checks	Local	medium
470505	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	medium
341880	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2071)	Nessus	Amazon Linux Local Security Checks	Local	high
335722	Linux Distros Unpatched Vulnerability : CVE-2026-72321	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-72321

high

Tenable Plugins

medium

medium

high

medium