All vulnerabilities
CVE-2026-98099

Linux: ipv6: mcast: use rcu_assign_pointer() for __rcu list updates

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0e3e3cec28c4d1bf29948da40b4e9e5d44f7852bAlso 49d7e1b456ba2f3ee08b3e264d999c09992cde8e, 2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6 and 1 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 0e3e3cec28c4d1bf29948da40b4e9e5d44f7852bLinuxCVE List
  • 49d7e1b456ba2f3ee08b3e264d999c09992cde8eLinuxCVE List
  • 2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6LinuxCVE List
  • 0c8f56c583c3250408367880c98e4d6fbc929315LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: use rcu_assign_pointer() for __rcu list updates

Several places in net/ipv6/mcast.c update RCU-protected lists (np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer assignments instead of rcu_assign_pointer():

  1. In __ipv6_dev_mc_dec(), unlinking a group from idev->mc_list did:

*map = ma->next; without rcu_assign_pointer() while concurrent readers traverse idev->mc_list locklessly under rcu_read_lock().

  1. In ipv6_sock_mc_drop() and __ipv6_sock_mc_close(), unlinking a group

from np->ipv6_mc_list directly assigned *lnk = mc_lst->next and np->ipv6_mc_list = mc_lst->next without rcu_assign_pointer(), racing with lockless readers in inet6_mc_check().

  1. In __ipv6_sock_mc_join(), mc_lst->next was initialized to

np->ipv6_mc_list via raw assignment before publishing mc_lst.

  1. In mld_del_delrec() and __ipv6_dev_mc_inc(), __rcu source pointers

passed into rcu_assign_pointer() lacked explicit dereference helpers.

Fix these by consistently using rcu_assign_pointer() along with mc_dereference() / sock_dereference().

Text from CVE List

Affected versions 12

  • Linuxaffected: 456b61bca8ee324ab6c18b065e632c9a8c88aa39 before 0e3e3cec28c4d1bf29948da40b4e9e5d44f7852bCVE List
  • Linuxaffected: 456b61bca8ee324ab6c18b065e632c9a8c88aa39 before 49d7e1b456ba2f3ee08b3e264d999c09992cde8eCVE List
  • Linuxaffected: 456b61bca8ee324ab6c18b065e632c9a8c88aa39 before afca229b39acc2590976b3e4f6e0fe76cededc60CVE List
  • Linuxaffected: 456b61bca8ee324ab6c18b065e632c9a8c88aa39 before 2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6CVE List
  • Linuxaffected: 456b61bca8ee324ab6c18b065e632c9a8c88aa39 before 0c8f56c583c3250408367880c98e4d6fbc929315CVE List
  • Linuxaffected: 2.6.38CVE List
  • Linuxunaffected: all versions before 2.6.38CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5