CVE-2026-98102

ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()

When removing a source filter whose count reaches zero, ip6_mc_del1_src() unlinks psf from pmc->mca_sources. If the filter was previously active, the code moved psf directly into pmc->mca_tomb by updating psf->sf_next.

Because pmc->mca_sources is traversed locklessly under RCU (e.g. by ipv6_chk_mcast_addr()), mutating psf->sf_next before a grace period elapses diverts concurrent readers to the tombstone list. Consequently, readers miss remaining active sources in pmc->mca_sources and improperly examine deleted tombstone entries.

Fix this by allocating a new tombstone node for pmc->mca_tomb (as done in sf_setstate()) and retiring the original psf via kfree_rcu().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4b200e398953c237c86d32bf26d4cb2a96556a6f to before c3343cd7ec8706c221e52b782f386b9af14a928aAffected 4b200e398953c237c86d32bf26d4cb2a96556a6f to before 4352737297b262e8367675c19a7dc6a9f53c97afAffected 4b200e398953c237c86d32bf26d4cb2a96556a6f to before 8d4fe5c13f5056faa6deb09a90e24a89f9ebfad4Affected 4b200e398953c237c86d32bf26d4cb2a96556a6f to before 5149c60c406595b56fda0c6e9aae7fd287f636aaAffected 4b200e398953c237c86d32bf26d4cb2a96556a6f to before 93b49239840b91313adbd77b8b52993eff2d08c1Affected 86c49119f0353f857cc08030ec9e4ebaab3d5a64Affected 5.10.261 to before 5.11Affected
LinuxLinux	5.13Affected before 5.13Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4b200e398953c237c86d32bf26d4cb2a96556a6f to before c3343cd7ec8706c221e52b782f386b9af14a928aAffected
4b200e398953c237c86d32bf26d4cb2a96556a6f to before 4352737297b262e8367675c19a7dc6a9f53c97afAffected
4b200e398953c237c86d32bf26d4cb2a96556a6f to before 8d4fe5c13f5056faa6deb09a90e24a89f9ebfad4Affected
4b200e398953c237c86d32bf26d4cb2a96556a6f to before 5149c60c406595b56fda0c6e9aae7fd287f636aaAffected
4b200e398953c237c86d32bf26d4cb2a96556a6f to before 93b49239840b91313adbd77b8b52993eff2d08c1Affected
86c49119f0353f857cc08030ec9e4ebaab3d5a64Affected
5.10.261 to before 5.11Affected

LinuxLinux

5.13Affected
before 5.13Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.