CVE-2026-98099: ipv6: mcast: use rcu_assign_pointer() for __rcu list updates

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-25 · updated 2026-10-28
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu_assign_pointer() for __rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists (np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer assignments instead of rcu_assign_pointer(): 1. In __ipv6_dev_mc_dec(), unlinking a group from idev->mc_list did: *map = ma->next; without rcu_assign_pointer() while concurrent readers traverse idev->mc_list locklessly under rcu_read_lock(). 2. In ipv6_sock_mc_drop() and __ipv6_sock_mc_close(), unlinking a group from np->ipv6_mc_list directly assigned *lnk = mc_lst->next and np->ipv6_mc_list = mc_lst->next without rcu_assign_pointer(), racing with lockless readers in inet6_mc_check(). 3. In __ipv6_sock_mc_join(), mc_lst->next was initialized to np->ipv6_mc_list via raw assignment before publishing mc_lst. 4. In mld_del_delrec() and __ipv6_dev_mc_inc(), __rcu source pointers passed into rcu_assign_pointer() lacked explicit dereference helpers. Fix these by consistently using rcu_assign_pointer() along with mc_dereference() / sock_dereference().

Affected products

Linux kernel: from 2.6.38 before 6.6.160; from 6.7 before 6.12.114; from 6.13 before 6.18.57; from 6.19 before 7.2.7; 7.3-rc1 — fixed in 6.6.160, 6.12.114, 6.18.57, 7.2.7
Linux kernel: 2.6.38 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 6.6.160, 6.12.114, 6.18.57, 7.2.7; Linux kernel 7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98099 or the next vulnerability affects your stack