CVE-2026-98103
Received Received - Intake

Use-After-Free in Linux Kernel igmp

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: igmp: convert struct ip_sf_list to RCU Commit 23d2b94043ca ("igmp: Add ip_mc_list lock in ip_check_mc_rcu") added spin_lock_bh(&im->lock) to ip_check_mc_rcu() to prevent a use-after-free while iterating im->sources during concurrent deletions. However, ip_check_mc_rcu() is called from RCU read-side critical sections in packet receive and route lookup fast paths (e.g. __mkroute_output(), ip_route_input_rcu(), and __udp4_lib_rcv()). When igmpv3_send_cr() or igmpv3_send_report() holds &pmc->lock and calls add_grec() -> igmpv3_newpack() -> ip_route_output_ports(), an XFRM policy matching a multicast destination triggers xfrm_tmpl_resolve_one() -> xfrm4_get_saddr() -> __mkroute_output() -> ip_check_mc_rcu(). This attempts to acquire &im->lock while &pmc->lock is already held on the same CPU, triggering a lockdep recursive locking warning / deadlock. Fix this by converting IPv4 struct ip_sf_list to RCU, mirroring the IPv6 implementation in net/ipv6/mcast.c: 1. Add struct rcu_head to struct ip_sf_list and annotate sf_next, sources, and tomb as __rcu pointers. 2. Use rcu_assign_pointer() and kfree_rcu() for list updates and deletions. 3. Remove spin_lock_bh(&im->lock) from ip_check_mc_rcu() and traverse im->sources locklessly with for_each_psf_rcu(), reading and writing counter fields with READ_ONCE() and WRITE_ONCE(). Note: RCU conversion of /proc/net/mcfilter will be done in a separate patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98103
EUVD
EUVD-2026-86934

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a potential deadlock in the IGMP (Internet Group Management Protocol) handling code. It occurs when a function called ip_check_mc_rcu() is accessed from RCU read-side critical sections during packet processing. The issue arises because ip_check_mc_rcu() tries to acquire a lock while another function already holds a different lock on the same CPU, leading to a recursive locking warning or deadlock.

Detection Guidance

This vulnerability is specific to the Linux kernel's IGMP implementation and may not have direct detection commands. It manifests as a lockdep recursive locking warning or deadlock during multicast routing operations. Monitor kernel logs for lockdep warnings or system hangs during multicast traffic processing.

Impact Analysis

This vulnerability could cause system hangs or crashes if exploited, leading to denial-of-service conditions. It may disrupt network multicast operations, affecting applications relying on group communication. Systems using IPv4 multicast with IGMPv3 could experience instability or unresponsiveness.

Mitigation Strategies

Apply the kernel patch that converts struct ip_sf_list to RCU. Update to a Linux kernel version that includes the fix (commit 23d2b94043ca or later). If immediate patching is not possible, avoid multicast-intensive operations or restrict multicast traffic until the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98103. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart