CVE-2026-98102 ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()
A race condition in Linux kernel IPv6 multicast handling allows concurrent readers to miss active sources or examine deleted entries, potentially causing data inconsistency or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98102?
CVE-2026-98102 is a vulnerability in Linux, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()
When removing a source filter whose count reaches zero, ip6_mc_del1_src() unlinks psf from pmc->mca_sources. If the filter was previously active, the code moved psf directly into pmc->mca_tomb by updating psf->sf_next.
Because pmc->mca_sources is traversed locklessly under RCU (e.g. by ipv6_chk_mcast_addr()), mutating psf->sf_next before a grace period elapses diverts concurrent readers to the tombstone list. Consequently, readers miss remaining active sources in pmc->mca_sources and improperly examine deleted tombstone entries.
Fix this by allocating a new tombstone node for pmc->mca_tomb (as done in sf_setstate()) and retiring the original psf via kfree_rcu().
Which versions are affected by CVE-2026-98102?
How do I fix CVE-2026-98102?
Apply the vendor's patch.
Is CVE-2026-98102 being exploited?
There is no known exploitation of CVE-2026-98102 in the wild and no public exploit code.
Sources
Also known as AZL-104442, BELL-CVE-2026-98102, DEBIAN-CVE-2026-98102, GHSA-g228-xhf6-wqq6, UBUNTU-CVE-2026-98102.