All vulnerabilities
CVE-2026-98101

Linux: ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2c2091e2ee93049fc513ad1e6c99d8b6c809f467Also 20db91a052332ef5552bd2f651ffb9db911cf67b, 5.11CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 2c2091e2ee93049fc513ad1e6c99d8b6c809f467LinuxCVE List
  • 20db91a052332ef5552bd2f651ffb9db911cf67bLinuxCVE List
  • 5.11LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()

pmc->sflist is read locklessly under rcu_read_lock() by inet6_mc_check() during packet reception in the UDP and RAW multicast receive paths.

ip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place when adding or removing a source filter. Additionally, when expanding the filter buffer, newpsl was published via rcu_assign_pointer() before writing the new source into the array.

Because 16-byte struct in6_addr writes are not atomic and array shifting is not synchronized with RCU readers, concurrent readers in inet6_mc_check() could read torn IPv6 addresses or observe duplicated/missed source entries.

Fix this by switching ip6_mc_source() to copy-on-write RCU updates: allocate and fully populate newpsl before publishing it via rcu_assign_pointer(), and reclaim the old filter via kfree_rcu(), matching ip6_mc_msfilter().

Also remove the now unused IP6_SFBLOCK macro.

Text from CVE List

Affected versions 14

  • Linuxaffected: 882ba1f73c06831f2a21044ebd8864c485ac04f2 before ac51321d3b2391860a935820ebcf4d8b9bb16a8aCVE List
  • Linuxaffected: 882ba1f73c06831f2a21044ebd8864c485ac04f2 before dba00514bf668c26cb4900e9f0da84bf96bf065aCVE List
  • Linuxaffected: 882ba1f73c06831f2a21044ebd8864c485ac04f2 before 2c2091e2ee93049fc513ad1e6c99d8b6c809f467CVE List
  • Linuxaffected: 882ba1f73c06831f2a21044ebd8864c485ac04f2 before 20db91a052332ef5552bd2f651ffb9db911cf67bCVE List
  • Linuxaffected: 882ba1f73c06831f2a21044ebd8864c485ac04f2 before c073d1b070f171d206b19c98d71739a97f15b3f1CVE List
  • Linuxaffected: 47c75e3923c8d562fea8daf0ccf31546a7bef0eaCVE List
  • Linuxaffected: 5.10.261 before 5.11CVE List
  • Linuxaffected: 5.13CVE List
  • Linuxunaffected: all versions before 5.13CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5