CVE-2026-98099

Analyzed Analyzed - Analysis Complete

RCU Pointer Update Missing in IPv6 Multicast List Handling

Publication date: 2026-09-25

Last updated on: 2026-10-28

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu_assign_pointer() for __rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists (np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer assignments instead of rcu_assign_pointer(): 1. In __ipv6_dev_mc_dec(), unlinking a group from idev->mc_list did: *map = ma->next; without rcu_assign_pointer() while concurrent readers traverse idev->mc_list locklessly under rcu_read_lock(). 2. In ipv6_sock_mc_drop() and __ipv6_sock_mc_close(), unlinking a group from np->ipv6_mc_list directly assigned *lnk = mc_lst->next and np->ipv6_mc_list = mc_lst->next without rcu_assign_pointer(), racing with lockless readers in inet6_mc_check(). 3. In __ipv6_sock_mc_join(), mc_lst->next was initialized to np->ipv6_mc_list via raw assignment before publishing mc_lst. 4. In mld_del_delrec() and __ipv6_dev_mc_inc(), __rcu source pointers passed into rcu_assign_pointer() lacked explicit dereference helpers. Fix these by consistently using rcu_assign_pointer() along with mc_dereference() / sock_dereference().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-28

Generated

2026-11-08

AI Q&A

2026-09-25

EPSS Evaluated

2026-11-07

NVD

CVE-2026-98099

EUVD

EUVD-2026-86929

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.2.7 (exc)
linux	linux_kernel	7.3
linux	linux_kernel	From 6.7 (inc) to 6.12.114 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.57 (exc)
linux	linux_kernel	From 2.6.38 (inc) to 6.6.160 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper handling of RCU-protected linked lists in the Linux kernel's IPv6 multicast code. Instead of using the safe rcu_assign_pointer() function for pointer updates, direct assignments were made, which could lead to race conditions with concurrent readers accessing these lists under RCU read lock.

Detection Guidance

This vulnerability involves improper RCU pointer updates in the Linux kernel's IPv6 multicast code. Detection requires checking kernel versions and examining the affected source files for direct pointer assignments instead of rcu_assign_pointer(). Use commands like 'uname -a' to check kernel version and 'grep -r "\*map = ma->next" /usr/src/linux/net/ipv6/mcast.c' to inspect the code for vulnerable patterns.

Impact Analysis

This vulnerability could cause kernel memory corruption or crashes due to race conditions when modifying multicast group lists. It may lead to system instability, denial of service, or potential privilege escalation if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to Linux kernel IPv6 multicast list handling. The issue involves improper RCU pointer updates in network stack code, which could lead to race conditions but does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Apply the latest kernel security updates from your Linux distribution to patch the vulnerable code. If immediate patching is not possible, consider disabling IPv6 multicast functionality temporarily as a workaround, though this may impact network services relying on it.

Hi! I’m here to help you understand CVE-2026-98099. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...