{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98101", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.315Z", "datePublished": "2026-09-25T10:35:52.731Z", "dateUpdated": "2026-10-19T09:13:53.770Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:13:53.770Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()\n\npmc->sflist is read locklessly under rcu_read_lock() by\ninet6_mc_check() during packet reception in the UDP and RAW\nmulticast receive paths.\n\nip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place\nwhen adding or removing a source filter. Additionally, when expanding\nthe filter buffer, newpsl was published via rcu_assign_pointer()\nbefore writing the new source into the array.\n\nBecause 16-byte struct in6_addr writes are not atomic and array\nshifting is not synchronized with RCU readers, concurrent readers in\ninet6_mc_check() could read torn IPv6 addresses or observe\nduplicated/missed source entries.\n\nFix this by switching ip6_mc_source() to copy-on-write RCU updates:\nallocate and fully populate newpsl before publishing it via\nrcu_assign_pointer(), and reclaim the old filter via kfree_rcu(),\nmatching ip6_mc_msfilter().\n\nAlso remove the now unused IP6_SFBLOCK macro."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/if_inet6.h", "net/ipv6/mcast.c"], "versions": [{"version": "882ba1f73c06831f2a21044ebd8864c485ac04f2", "lessThan": "ac51321d3b2391860a935820ebcf4d8b9bb16a8a", "status": "affected", "versionType": "git"}, {"version": "882ba1f73c06831f2a21044ebd8864c485ac04f2", "lessThan": "dba00514bf668c26cb4900e9f0da84bf96bf065a", "status": "affected", "versionType": "git"}, {"version": "882ba1f73c06831f2a21044ebd8864c485ac04f2", "lessThan": "2c2091e2ee93049fc513ad1e6c99d8b6c809f467", "status": "affected", "versionType": "git"}, {"version": "882ba1f73c06831f2a21044ebd8864c485ac04f2", "lessThan": "20db91a052332ef5552bd2f651ffb9db911cf67b", "status": "affected", "versionType": "git"}, {"version": "882ba1f73c06831f2a21044ebd8864c485ac04f2", "lessThan": "c073d1b070f171d206b19c98d71739a97f15b3f1", "status": "affected", "versionType": "git"}, {"version": "47c75e3923c8d562fea8daf0ccf31546a7bef0ea", "status": "affected", "versionType": "git"}, {"version": "5.10.261", "lessThan": "5.11", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/if_inet6.h", "net/ipv6/mcast.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.261"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ac51321d3b2391860a935820ebcf4d8b9bb16a8a"}, {"url": "https://git.kernel.org/stable/c/dba00514bf668c26cb4900e9f0da84bf96bf065a"}, {"url": "https://git.kernel.org/stable/c/2c2091e2ee93049fc513ad1e6c99d8b6c809f467"}, {"url": "https://git.kernel.org/stable/c/20db91a052332ef5552bd2f651ffb9db911cf67b"}, {"url": "https://git.kernel.org/stable/c/c073d1b070f171d206b19c98d71739a97f15b3f1"}], "title": "ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/if_inet6.h", "net/ipv6/mcast.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ac51321d3b2391860a935820ebcf4d8b9bb16a8a", "status": "affected", "version": "882ba1f73c06831f2a21044ebd8864c485ac04f2", "versionType": "git"}, {"lessThan": "dba00514bf668c26cb4900e9f0da84bf96bf065a", "status": "affected", "version": "882ba1f73c06831f2a21044ebd8864c485ac04f2", "versionType": "git"}, {"lessThan": "2c2091e2ee93049fc513ad1e6c99d8b6c809f467", "status": "affected", "version": "882ba1f73c06831f2a21044ebd8864c485ac04f2", "versionType": "git"}, {"lessThan": "20db91a052332ef5552bd2f651ffb9db911cf67b", "status": "affected", "version": "882ba1f73c06831f2a21044ebd8864c485ac04f2", "versionType": "git"}, {"lessThan": "c073d1b070f171d206b19c98d71739a97f15b3f1", "status": "affected", "version": "882ba1f73c06831f2a21044ebd8864c485ac04f2", "versionType": "git"}, {"status": "affected", "version": "47c75e3923c8d562fea8daf0ccf31546a7bef0ea", "versionType": "git"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.261", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/if_inet6.h", "net/ipv6/mcast.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()\n\npmc->sflist is read locklessly under rcu_read_lock() by\ninet6_mc_check() during packet reception in the UDP and RAW\nmulticast receive paths.\n\nip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place\nwhen adding or removing a source filter. Additionally, when expanding\nthe filter buffer, newpsl was published via rcu_assign_pointer()\nbefore writing the new source into the array.\n\nBecause 16-byte struct in6_addr writes are not atomic and array\nshifting is not synchronized with RCU readers, concurrent readers in\ninet6_mc_check() could read torn IPv6 addresses or observe\nduplicated/missed source entries.\n\nFix this by switching ip6_mc_source() to copy-on-write RCU updates:\nallocate and fully populate newpsl before publishing it via\nrcu_assign_pointer(), and reclaim the old filter via kfree_rcu(),\nmatching ip6_mc_msfilter().\n\nAlso remove the now unused IP6_SFBLOCK macro."}], "id": "CVE-2026-98101", "lastModified": "2026-10-19T10:18:07.260", "metrics": {}, "published": "2026-09-25T11:17:39.830", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/20db91a052332ef5552bd2f651ffb9db911cf67b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2c2091e2ee93049fc513ad1e6c99d8b6c809f467"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ac51321d3b2391860a935820ebcf4d8b9bb16a8a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c073d1b070f171d206b19c98d71739a97f15b3f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dba00514bf668c26cb4900e9f0da84bf96bf065a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Undergoing Analysis"}

{"bugzilla": {"description": "kernel: ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()", "id": "2541378", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541378"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-366", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()\npmc->sflist is read locklessly under rcu_read_lock() by\ninet6_mc_check() during packet reception in the UDP and RAW\nmulticast receive paths.\nip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place\nwhen adding or removing a source filter. Additionally, when expanding\nthe filter buffer, newpsl was published via rcu_assign_pointer()\nbefore writing the new source into the array.\nBecause 16-byte struct in6_addr writes are not atomic and array\nshifting is not synchronized with RCU readers, concurrent readers in\ninet6_mc_check() could read torn IPv6 addresses or observe\nduplicated/missed source entries.\nFix this by switching ip6_mc_source() to copy-on-write RCU updates:\nallocate and fully populate newpsl before publishing it via\nrcu_assign_pointer(), and reclaim the old filter via kfree_rcu(),\nmatching ip6_mc_msfilter().\nAlso remove the now unused IP6_SFBLOCK macro.", "A flaw was found in the Linux kernel's IPv6 networking subsystem. A race condition in the ip6_mc_source() function allows concurrent packet processing routines to observe inconsistent multicast source filter lists when entries are modified in place. A local user could exploit this flaw by changing multicast socket filter settings during active packet reception, causing torn address reads and corrupted filter state. This vulnerability can lead to improper packet filtering or a Denial of Service (DoS)."], "name": "CVE-2026-98101", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98101\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98101\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98101.mbox"], "threat_severity": "Low"}