A critical Use-After-Free vulnerability in the Linux kernel network stack allows unauthenticated attackers to potentially trigger system crashes or execute arbitrary code.

This is a Use-After-Free vulnerability caused by a race condition between inetdev_destroy and igmp_rcv. An unauthenticated attacker can trigger this flaw by interacting with the IGMP timer callback during device destruction, leading to memory corruption.

The CVSS score of 9.8 reflects the high risk posed by this vulnerability, as it allows for full system compromise without requiring user interaction or authentication. Successful exploitation leads to a kernel panic, resulting in significant service downtime, or potentially allows an attacker to execute malicious code with kernel-level privileges, leading to complete unauthorized system control and data exfiltration.

Immediate Action: Update the Linux kernel to version 6.6.145, 6.12.97, 6.18.40, 7.1.5, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panic events or unexpected process terminations, particularly those involving networking components or IGMP traffic.

Compensating Controls: Restrict network access to untrusted IGMP traffic via firewall rules where possible to reduce the attack surface until patches can be applied.

Public Exploit Available: Unknown

Given the critical nature of this kernel-level vulnerability and the potential for total system compromise, immediate remediation is required. Administrators should prioritize patching their Linux environments by applying the latest stable kernel updates as soon as they become available from their respective distribution maintainers.