In the Linux kernel’s IPv4 IGMP implementation, the functions igmp_mod_timer() and igmp_stop_timer() incorrectly decrement a multicast group’s reference counter when a timer is deleted or stopped. When these functions are invoked from an RCU reader path while the group’s reference count has already been reduced to one by a concurrent removal, calling refcount_dec() can bring the counter to zero without freeing the associated memory. This results in a memory leak of the multicast group structure. The vulnerability does not provide an attacker‑controlled code path or direct compromise, but repeated exploitation could lead to gradual exhaustion of kernel memory resources, potentially affecting system stability and availability.

The flaw is present in all releases of the Linux kernel containing the buggy IGMP code; the specific affected versions are not enumerated in the advisory. The vulnerability applies to any system running a standard Linux kernel with the aforementioned IGMP logic enabled.

The CVSS score is 5.5 and the EPSS score is less than 1%, and the issue is not listed in the CISA KEV catalog, indicating moderate perceived exploitability. The vulnerability is limited to internal kernel threads and requires a scenario where timers are repeatedly created and deleted in the presence of RCU readers, which is not trivially achievable from user space. Consequently, the risk is primarily the potential for resource exhaustion rather than immediate remote code execution or privilege escalation.