CVE-2026-98099: ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: use rcuassignpointer() for rcu list updates
Several places in net/ipv6/mcast.c update RCU-protected lists (np->ipv6mclist, idev->mclist, idev->mctomb) using direct pointer assignments instead of rcuassignpointer():
1. In ipv6devmcdec(), unlinking a group from idev->mclist did: map = ma->next; without rcuassignpointer() while concurrent readers traverse idev->mclist locklessly under rcureadlock(). 2. In ipv6sockmcdrop() and ipv6sockmcclose(), unlinking a group from np->ipv6mclist directly assigned lnk = mclst->next and np->ipv6mclist = mclst->next without rcuassignpointer(), racing with lockless readers in inet6mccheck(). 3. In ipv6sockmcjoin(), mclst->next was initialized to np->ipv6mclist via raw assignment before publishing mclst. 4. In mlddeldelrec() and ipv6devmcinc(), rcu source pointers passed into rcuassignpointer() lacked explicit dereference helpers.
Fix these by consistently using rcuassignpointer() along with mcdereference() / sockdereference().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.7-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.13-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.7 - Compensating control
Update net/ipv6/mcast.c so all RCU-protected list updates for np->ipv6_mc_list, idev->mc_list, and idev->mc_tomb use rcu_assign_pointer() instead of direct pointer assignments, and use mc_dereference() or sock_dereference() for the corresponding __rcu source pointers.
Event History
Frequently Asked Questions
What conditions are needed for this issue to occur?
The issue involves concurrent access to IPv6 multicast membership lists: one execution path updates or removes list entries while another traverses the same lists locklessly under RCU. The affected paths include IPv6 device multicast-group handling and IPv6 socket multicast join, drop, close, and membership-check operations.
How can I determine whether my system has the fix?
Check whether the kernel source or applied stable patches include the referenced commits 2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6 or 0c8f56c583c3250408367880c98e4d6fbc929315. The corrected code uses rcu_assign_pointer() when publishing or unlinking the relevant __rcu list pointers, with mc_dereference() or sock_dereference() for source-pointer access.