CVE-2026-98102ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()
- —Not scoredno CVSS score yet
- 0.17%Exploitation in 30 daysEPSS · top 94% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() When removing a source filter whose count reaches zero, ip6_mc_del1_src() unlinks psf from pmc->mca_sources. If the filter was previously active, the code moved psf directly into pmc->mca_tomb by updating psf->sf_next. Because pmc->mca_sources is traversed locklessly under RCU (e.g. by ipv6_chk_mcast_addr()), mutating psf->sf_next before a grace period elapses diverts concurrent readers to the tombstone list. Consequently, readers miss remaining active sources in pmc->mca_sources and improperly examine deleted tombstone entries. Fix this by allocating a new tombstone node for pmc->mca_tomb (as done in sf_setstate()) and retiring the original psf via kfree_rcu().
Timeline
ID reserved
By Linux
Published
- 24 days later
· 24 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Undergoing Analysis.
- EPSS (exploitation in 30 days)
- 0.17% · top 94% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 4b200e398953c237c86d32bf26d4cb2a96556a6f – < c3343cd7ec8706c221e52b782f386b9af14a928a
- affected 4b200e398953c237c86d32bf26d4cb2a96556a6f – < 4352737297b262e8367675c19a7dc6a9f53c97af
- affected 4b200e398953c237c86d32bf26d4cb2a96556a6f – < 8d4fe5c13f5056faa6deb09a90e24a89f9ebfad4
- affected 4b200e398953c237c86d32bf26d4cb2a96556a6f – < 5149c60c406595b56fda0c6e9aae7fd287f636aa
- affected 4b200e398953c237c86d32bf26d4cb2a96556a6f – < 93b49239840b91313adbd77b8b52993eff2d08c1
- affected 86c49119f0353f857cc08030ec9e4ebaab3d5a64
- affected 5.10.261 – < 5.11
- affected 5.13
- unaffected < 5.13
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.111 – ≤ 6.12.*
- unaffected 6.18.53 – ≤ 6.18.*
- unaffected 7.2.7 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References5
- https://git.kernel.org/stable/c/c3343cd7ec8706c221e52b782f386b9af14a928a (opens in a new tab)
- https://git.kernel.org/stable/c/4352737297b262e8367675c19a7dc6a9f53c97af (opens in a new tab)
- https://git.kernel.org/stable/c/8d4fe5c13f5056faa6deb09a90e24a89f9ebfad4 (opens in a new tab)
- https://git.kernel.org/stable/c/5149c60c406595b56fda0c6e9aae7fd287f636aa (opens in a new tab)
- https://git.kernel.org/stable/c/93b49239840b91313adbd77b8b52993eff2d08c1 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-86933 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98102)Record last updated .