CVE-2026-98102
Received Received - Intake

Use-After-Free in Linux Kernel IPv6 Multicast

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() When removing a source filter whose count reaches zero, ip6_mc_del1_src() unlinks psf from pmc->mca_sources. If the filter was previously active, the code moved psf directly into pmc->mca_tomb by updating psf->sf_next. Because pmc->mca_sources is traversed locklessly under RCU (e.g. by ipv6_chk_mcast_addr()), mutating psf->sf_next before a grace period elapses diverts concurrent readers to the tombstone list. Consequently, readers miss remaining active sources in pmc->mca_sources and improperly examine deleted tombstone entries. Fix this by allocating a new tombstone node for pmc->mca_tomb (as done in sf_setstate()) and retiring the original psf via kfree_rcu().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98102
EUVD
EUVD-2026-86933

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the IPv6 multicast source filter handling. When removing a source filter, the code incorrectly moves the filter directly into a tombstone list without proper RCU synchronization. This causes concurrent readers to miss active sources and access deleted entries due to improper pointer updates before a grace period elapses.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPv6 multicast source filter handling. Detection requires checking if your system is running a vulnerable kernel version. Use uname -a to check the kernel version and compare it against patched versions. No direct commands detect active exploitation as it involves internal RCU list corruption.

Impact Analysis

This could lead to kernel memory corruption or crashes if exploited. Systems relying on IPv6 multicast filtering may experience incorrect behavior, packet loss, or denial of service. Attackers on the local network could potentially trigger this issue to cause instability.

Mitigation Strategies

Immediately update your Linux kernel to a patched version that includes the fix for CVE-2026-98102. If immediate patching is not possible, restrict IPv6 multicast operations or disable IPv6 multicast if not required to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98102. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart