CVE-2026-98102: ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-25 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() When removing a source filter whose count reaches zero, ip6_mc_del1_src() unlinks psf from pmc->mca_sources. If the filter was previously active, the code moved psf directly into pmc->mca_tomb by updating psf->sf_next. Because pmc->mca_sources is traversed locklessly under RCU (e.g. by ipv6_chk_mcast_addr()), mutating psf->sf_next before a grace period elapses diverts concurrent readers to the tombstone list. Consequently, readers miss remaining active sources in pmc->mca_sources and improperly examine deleted tombstone entries. Fix this by allocating a new tombstone node for pmc->mca_tomb (as done in sf_setstate()) and retiring the original psf via kfree_rcu().

Affected products

Linux kernel: from 5.10.261 before 5.11; 5.13 — fixed in 5.11, 7.3

How to fix

Upgrade to a fixed version: Linux kernel 5.11, 7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98102 or the next vulnerability affects your stack