VulnerabilityPublished 25 Sep 2026Updated 19 Oct 2026

CVE-2026-98102: Linux kernel · ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in c3343cd7ec8706c221e52b782f386b9af14a928a : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in c3343cd7ec8706c221e52b782f386b9af14a928a, 4352737297b262e8367675c19a7dc6a9f53c97af, 5149c60c406595b56fda0c6e9aae7fd287f636aa +3

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=5.10.261 <5.11	Fixed in c3343cd7ec8706c221e52b782f386b9af14a928a 4352737297b262e8367675c19a7dc6a9f53c97af 5149c60c406595b56fda0c6e9aae7fd287f636aa 93b49239840b91313adbd77b8b52993eff2d08c1 8d4fe5c13f5056faa6deb09a90e24a89f9ebfad4 5.11
LinuxLinux	Affected =5.13	Fixed in–

AI-suggested

A fix is available and has been applied in Linux kernel version 5.11 and later. Users and administrators should upgrade to Linux kernel version 5.11 or later to remediate this vulnerability.

Description

A vulnerability in the Linux kernel's IPv6 multicast source filter removal function ip6_mc_del1_src() could cause concurrent readers to miss active sources and improperly examine deleted tombstone entries due to unsafe list pointer manipulation under RCU. This issue has been fixed by changing the handling of tombstone nodes to avoid mutating pointers before the RCU grace period elapses.

Impact

The vulnerability can cause incorrect behavior in IPv6 multicast source filtering by causing concurrent readers to miss active source filters and examine deleted tombstone entries. This could potentially lead to incorrect multicast packet processing or filtering decisions in the kernel's networking stack. No direct exploit or active exploitation is known.

Summary

CVE-2026-98102 addresses a flaw in the Linux kernel's IPv6 multicast code where the function ip6_mc_del1_src() improperly manipulates the RCU-protected linked list pmc->mca_sources when removing a source filter whose count reaches zero. The original code moved the source filter node directly into the tombstone list by updating its next pointer, which caused concurrent readers traversing pmc->mca_sources locklessly under RCU to be diverted to the tombstone list prematurely. This results in readers missing remaining active sources and incorrectly examining deleted tombstone entries. The fix involves allocating a new tombstone node for pmc->mca_tomb and retiring the original source filter node via kfree_rcu(), ensuring safe RCU list traversal.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 12:42 UTC

Technical details

References

Community reviews

Related threats