CVE-2026-98099 ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
A race condition in Linux kernel IPv6 multicast handling due to improper RCU pointer updates can lead to system instability or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98099?
CVE-2026-98099 is a medium-severity vulnerability in Linux kernel, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
Several places in net/ipv6/mcast.c update RCU-protected lists (np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer assignments instead of rcu_assign_pointer():
1. In __ipv6_dev_mc_dec(), unlinking a group from idev->mc_list did: *map = ma->next; without rcu_assign_pointer() while concurrent readers traverse idev->mc_list locklessly under rcu_read_lock(). 2. In ipv6_sock_mc_drop() and __ipv6_sock_mc_close(), unlinking a group from np->ipv6_mc_list directly assigned *lnk = mc_lst->next and np->ipv6_mc_list = mc_lst->next without rcu_assign_pointer(), racing with lockless readers in inet6_mc_check(). 3. In __ipv6_sock_mc_join(), mc_lst->next was initialized to np->ipv6_mc_list via raw assignment before publishing mc_lst. 4. In mld_del_delrec() and __ipv6_dev_mc_inc(), __rcu source pointers passed into rcu_assign_pointer() lacked explicit dereference helpers.
Fix these by consistently using rcu_assign_pointer() along with mc_dereference() / sock_dereference().
Weakness: CWE-362
Which versions are affected by CVE-2026-98099?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-98099?
Apply the vendor's patch.
Is CVE-2026-98099 being exploited?
There is no known exploitation of CVE-2026-98099 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-104745, BELL-CVE-2026-98099, DEBIAN-CVE-2026-98099, GHSA-5fxh-xwwm-73v4, UBUNTU-CVE-2026-98099.