UBUNTU-CVE-2026-98099: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer() for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists (np->ipv6mclist, idev->mclist, idev->mctomb) using direct pointer assignments instead of rcuassignpointer(): 1. In ipv6devmcdec(), unlinking a group from idev->mclist did: map = ma->next; without rcuassignpointer() while concurrent readers traverse idev->mclist locklessly under rcureadlock(). 2. In ipv6sockmcdrop() and ipv6sockmcclose(), unlinking a group from np->ipv6mclist directly assigned lnk = mclst->next and np->ipv6mclist = mclst->next without rcuassignpointer(), racing with lockless readers in inet6mccheck(). 3. In ipv6sockmcjoin(), mclst->next was initialized to np->ipv6mclist via raw assignment before publishing mclst. 4. In mlddeldelrec() and ipv6devmcinc(), rcu source pointers passed into rcuassignpointer() lacked explicit dereference helpers. Fix these by consistently using rcuassignpointer() along with mcdereference() / sockdereference().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In net/ipv6/mcast.c, update RCU-protected list pointers in __ipv6_dev_mc_dec(), __ipv6_sock_mc_join(), ipv6_sock_mc_drop(), __ipv6_sock_mc_close(), mld_del_delrec(), and __ipv6_dev_mc_inc() using rcu_assign_pointer() consistently, together with mc_dereference() or sock_dereference() for __rcu source pointers.