CVE-2026-98102 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()
When removing a source filter whose count reaches zero, ip6_mc_del1_src() unlinks psf from pmc->mca_sources. If the filter was previously active, the code moved psf directly into pmc->mca_tomb by updating psf->sf_next.
Because pmc->mca_sources is traversed locklessly under RCU (e.g. by ipv6_chk_mcast_addr()), mutating psf->sf_next before a grace period elapses diverts concurrent readers to the tombstone list. Consequently, readers miss remaining active sources in pmc->mca_sources and improperly examine deleted tombstone entries.
Fix this by allocating a new tombstone node for pmc->mca_tomb (as done in sf_setstate()) and retiring the original psf via kfree_rcu().
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified as CVE-2024-10859 resides within the IPv6 multicast source filtering implementation of the Linux kernel, specifically affecting the ip6_mc_del1_src function. This flaw represents a classic race condition involving Read-Copy-Update (RCU) synchronization primitives and linked list manipulation in a concurrent environment. The core issue arises when an application requests the removal of a specific IP address from a multicast source filter list, causing the count of active sources for that group to reach zero. In this scenario, the kernel attempts to move the source filter structure, referred to as psf, from the main active source list pmc->mca_sources into a tombstone list pmc->mca_tomb to facilitate deferred cleanup and prevent use-after-free errors during ongoing read-side critical sections.
The technical flaw lies in how this transition is executed under RCU protection. The kernel traverses these lists locklessly using RCU, meaning that readers can access the data structures without acquiring traditional locks like mutexes or spinlocks, relying instead on grace periods to ensure safe memory reclamation. However, when ip6_mc_del1_src() moves psf into the tombstone list by directly updating its sf_next pointer, it modifies a node that is still potentially being traversed by concurrent readers operating under an RCU read-side critical section. This direct mutation diverts these ongoing traversal operations away from the active source list and onto the tombstone list prematurely. Consequently, readers may miss valid, remaining active sources in pmc->mca_sources because their iteration logic expects to follow pointers within the primary list structure rather than encountering a node that has been logically removed but not yet safely reclaimed.
The operational impact of this vulnerability is significant for network stack stability and correctness. When concurrent RCU readers are diverted to examine deleted tombstone entries, they may process invalid or stale data structures intended only for deferred cleanup. This can lead to incorrect multicast address resolution results via functions such as ipv6_chk_mcast_addr(), potentially causing packet delivery failures, routing anomalies, or unexpected behavior in applications relying on precise IPv6 multicast group membership state. In severe cases, the misinterpretation of list pointers could contribute to kernel panics or memory corruption if subsequent operations assume the structural integrity of lists that have been improperly interleaved due to this race condition. This aligns with CWE-362, which describes concurrent execution using shared resources without proper synchronization, and specifically relates to improper handling of RCU grace periods in linked list modifications as seen in CWE-824 or related access control flaws depending on the specific exploitation vector.
The mitigation implemented by the Linux kernel maintainers addresses this race condition by ensuring that tombstone entries are handled with strict adherence to RCU semantics. Instead of directly mutating the psf node and inserting it into the tombstone list, which risks interfering with active traversals, the fix allocates a new, separate tombstone node for pmc->mca_tomb. The original psf structure is then retired using kfree_rcu(), a mechanism that schedules its memory deallocation only after all pre-existing RCU read-side critical sections have completed their grace period. This approach decouples the logical removal of the source from the physical reclamation of its memory, ensuring that concurrent readers always traverse consistent list structures and never encounter partially updated pointers or diverted paths during active lookups.
To mitigate this vulnerability in deployed systems, administrators should apply the latest available kernel updates provided by their distribution vendors, as these patches incorporate the corrected RCU handling logic for IPv6 multicast source filtering. For environments where immediate patching is not feasible, monitoring network logs for unusual multicast traffic patterns or kernel oops messages related to ipv6_mc_del1_src may provide early indicators of exploitation attempts, although direct remote code execution via this specific flaw is unlikely given its nature as a data consistency and race condition issue rather than an input validation bypass. Maintaining up-to-date kernels remains the primary defense against such concurrency-related vulnerabilities in network subsystems.