CVE-2026-49412: Use-after-free bug in the IPV6_MSFILTER socket option handler
The kernel handler for IPV6MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread could free the multicast filter structure, leaving the handler with a stale pointer to freed memory.
An unprivileged local user can exploit this use-after-free to escalate privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49412?
The severity of CVE-2026-49412 is rated at 72.
How do I fix CVE-2026-49412?
To fix CVE-2026-49412, update your system to the latest version of the software that addresses this vulnerability.
What systems are affected by CVE-2026-49412?
CVE-2026-49412 affects systems that utilize the IPV6_MSFILTER socket option.
What type of vulnerability is CVE-2026-49412?
CVE-2026-49412 is classified as a use-after-free vulnerability.
What could happen if CVE-2026-49412 is exploited?
Exploitation of CVE-2026-49412 could allow an unprivileged local attacker to execute arbitrary code or cause a denial of service.