All vulnerabilities
CVE-2026-98103

Linux: igmp: convert struct ip_sf_list to RCU

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in01131daffc4b64f1652e23dc3e6e2f601eda781dAlso 2987ee196c88dbde0463dc87d5fb209c684e34a2, 4.5 and 7 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

Show all 10 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

igmp: convert struct ip_sf_list to RCU

Commit 23d2b94043ca ("igmp: Add ip_mc_list lock in ip_check_mc_rcu") added spin_lock_bh(&im->lock) to ip_check_mc_rcu() to prevent a use-after-free while iterating im->sources during concurrent deletions.

However, ip_check_mc_rcu() is called from RCU read-side critical sections in packet receive and route lookup fast paths (e.g. __mkroute_output(), ip_route_input_rcu(), and __udp4_lib_rcv()).

When igmpv3_send_cr() or igmpv3_send_report() holds &pmc->lock and calls add_grec() -> igmpv3_newpack() -> ip_route_output_ports(), an XFRM policy matching a multicast destination triggers xfrm_tmpl_resolve_one() -> xfrm4_get_saddr() -> __mkroute_output() -> ip_check_mc_rcu(). This attempts to acquire &im->lock while &pmc->lock is already held on the same CPU, triggering a lockdep recursive locking warning / deadlock.

Fix this by converting IPv4 struct ip_sf_list to RCU, mirroring the IPv6 implementation in net/ipv6/mcast.c:

  1. Add struct rcu_head to struct ip_sf_list and annotate sf_next,

sources, and tomb as __rcu pointers.

  1. Use rcu_assign_pointer() and kfree_rcu() for list updates and

deletions.

  1. Remove spin_lock_bh(&im->lock) from ip_check_mc_rcu() and traverse

im->sources locklessly with for_each_psf_rcu(), reading and writing counter fields with READ_ONCE() and WRITE_ONCE().

Note: RCU conversion of /proc/net/mcfilter will be done in a separate patch.

Text from CVE List

Affected versions 28

  • Linuxaffected: 23d2b94043ca8835bd1e67749020e839f396a1c2 before 01131daffc4b64f1652e23dc3e6e2f601eda781dCVE List
  • Linuxaffected: 23d2b94043ca8835bd1e67749020e839f396a1c2 before f5182dfad54277267a8cb0c004a9cd4cf35aeebbCVE List
  • Linuxaffected: 23d2b94043ca8835bd1e67749020e839f396a1c2 before d3011d1f293478c730aa0870490afa145c37600eCVE List
  • Linuxaffected: 23d2b94043ca8835bd1e67749020e839f396a1c2 before e3206419bdb04e2087d8cc6be324df8639b3fac5CVE List
  • Linuxaffected: 23d2b94043ca8835bd1e67749020e839f396a1c2 before 2987ee196c88dbde0463dc87d5fb209c684e34a2CVE List
  • Linuxaffected: b24065948ae6c48c9e20891f8cfe9850f1d748beCVE List
  • Linuxaffected: e9924c4204ede999b0515fd31a370a1e27f676bcCVE List
  • Linuxaffected: 78967749984cf3614de346c90f3e259ff8272735CVE List
  • Linuxaffected: 4768973dffed4d0126854514335ed4fe87bec1abCVE List
  • Linuxaffected: d84708451d9041dff8a81e3718f821f12d2eb6c5CVE List
  • Linuxaffected: ddd7e8b7b84836c584a284b98ca9bd7a348a0558CVE List
  • Linuxaffected: 961447ff60291b91e27d5c32fa549c1411ad3b70CVE List
  • Linuxaffected: d1a3c6d5925a8d00a32c5ef2d674dd9c0ce89c95CVE List
  • Linuxaffected: 4.4.284 before 4.5CVE List
  • Linuxaffected: 4.9.283 before 4.10CVE List
  • Linuxaffected: 4.14.247 before 4.15CVE List
  • Linuxaffected: 4.19.207 before 4.20CVE List
  • Linuxaffected: 5.4.145 before 5.5CVE List
  • Linuxaffected: 5.10.64 before 5.11CVE List
  • Linuxaffected: 5.13.16 before 5.14CVE List
  • Linuxaffected: 5.14.3 before 5.15CVE List
  • Linuxaffected: 5.15CVE List
  • Linuxunaffected: all versions before 5.15CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5