CVE-2026-98102: ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: fix RCU list diversion in ip6mcdel1src()
When removing a source filter whose count reaches zero, ip6mcdel1src() unlinks psf from pmc->mcasources. If the filter was previously active, the code moved psf directly into pmc->mcatomb by updating psf->sfnext.
Because pmc->mcasources is traversed locklessly under RCU (e.g. by ipv6chkmcastaddr()), mutating psf->sfnext before a grace period elapses diverts concurrent readers to the tombstone list. Consequently, readers miss remaining active sources in pmc->mcasources and improperly examine deleted tombstone entries.
Fix this by allocating a new tombstone node for pmc->mcatomb (as done in sfsetstate()) and retiring the original psf via kfreercu().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
When removing a source filter whose count reaches zero, allocate a new tombstone node for pmc->mca_tomb and retire the original psf via kfree_rcu(); do not move psf directly into pmc->mca_tomb by modifying psf->sf_next before an RCU grace period.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running the Linux kernel with IPv6 multicast source filtering in use are exposed to the affected code path. The issue involves concurrent RCU-based traversal of IPv6 multicast source lists while a source filter is removed.
What conditions are required to trigger the incorrect behavior?
A source filter must be removed such that its count reaches zero, and the filter must previously have been active. A concurrent lockless RCU reader, such as ipv6_chk_mcast_addr(), must traverse the multicast source list during the removal.
What is the observable impact of the race?
Concurrent readers can be diverted from the active source list to the tombstone list. This can cause them to miss remaining active sources and examine source entries that were deleted.
How does the fix mitigate the issue?
The fix creates a separate tombstone node instead of repurposing the removed active-source node. The original node is retired with kfree_rcu(), preventing its next-pointer from being changed before existing RCU readers have completed.