CVE-2026-98101

Awaiting Analysis Awaiting Analysis - Queue

Race Condition in IPv6 Multicast Source Filtering

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() pmc->sflist is read locklessly under rcu_read_lock() by inet6_mc_check() during packet reception in the UDP and RAW multicast receive paths. ip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place when adding or removing a source filter. Additionally, when expanding the filter buffer, newpsl was published via rcu_assign_pointer() before writing the new source into the array. Because 16-byte struct in6_addr writes are not atomic and array shifting is not synchronized with RCU readers, concurrent readers in inet6_mc_check() could read torn IPv6 addresses or observe duplicated/missed source entries. Fix this by switching ip6_mc_source() to copy-on-write RCU updates: allocate and fully populate newpsl before publishing it via rcu_assign_pointer(), and reclaim the old filter via kfree_rcu(), matching ip6_mc_msfilter(). Also remove the now unused IP6_SFBLOCK macro.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98101

EUVD

EUVD-2026-86932

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in IPv6 multicast source filtering. The issue occurs when the ip6_mc_source() function modifies multicast source filter lists without proper synchronization under RCU (Read-Copy-Update) locks. This can lead to concurrent readers observing inconsistent or corrupted data, such as torn IPv6 addresses or incorrect source entries during packet processing.

Detection Guidance

This vulnerability affects the Linux kernel's IPv6 multicast source filtering. Detection requires checking kernel versions and examining network stack behavior. Use commands like 'uname -a' to check kernel version and 'dmesg | grep -i mcast' to look for multicast-related errors. Monitor network traffic for anomalies in IPv6 multicast packets.

Impact Analysis

This vulnerability could allow attackers to manipulate multicast traffic processing, potentially causing denial-of-service conditions or unauthorized data interception. Systems relying on IPv6 multicast for critical operations may experience crashes, incorrect packet handling, or security bypasses due to corrupted filter lists.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel memory corruption issue in IPv6 multicast handling that could lead to data corruption or crashes, but does not involve unauthorized data access or disclosure required for these regulations.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution. If patches are unavailable, consider disabling IPv6 multicast or restricting multicast traffic at the network perimeter. Update firewall rules to block suspicious IPv6 multicast packets until the fix is applied.

Hi! I’m here to help you understand CVE-2026-98101. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70