DEBIAN-CVE-2026-72323

In the Linux kernel, the following vulnerability has been resolved:  ipv4: igmp: Fix potential UAF in igmpgqstarttimer()  A race condition exists between device teardown (inetdevdestroy) and incoming IGMP query processing (igmprcv), leading to a Use-After-Free in the IGMP timer callback.  During device destruction, inetdevdestroy() drops the primary reference to indevice, which can drop its refcount to 0. The actual freeing of indevice memory is deferred via RCU (using callrcu()).  Concurrently, igmprcv() runs under RCU read lock and obtains the indevice pointer. Because the memory is RCU-protected, CPU-0 can safely dereference indevice even if its refcount has hit 0.  However, if CPU-0 calls igmpgqstarttimer() and re-arms the timer, it attempts to acquire a reference using indevhold(). This increments the refcount from 0 to 1, triggering a "refcountt: addition on 0" warning. Since the indevice memory is still scheduled to be freed after the RCU grace period (as the free callback does not check the refcount again), the device is freed while the timer is still armed. When the timer expires, it accesses the freed memory, causing a kernel panic.  Fix this by using refcountincnotzero() (via a new helper indevhold_safe()) to prevent acquiring a reference if the device is already being destroyed. If the refcount is 0, we do not arm the timer.  A similar issue in IPv6 MLD is fixed in a subsequent patch.