CVE-2026-98099 is a medium severity vulnerability in the Linux kernel's IPv6 multicast implementation. It involves improper updates to RCU-protected lists using direct pointer assignments instead of the required rcu_assign_pointer() function. This can cause race conditions with concurrent lockless readers, potentially leading to denial of service due to kernel instability or crashes. The issue affects multiple functions in net/ipv6/mcast.c related to multicast group list management. The vulnerability has been fixed by consistently applying rcu_assign_pointer() and appropriate dereference helpers.