CVE-2026-98099
ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu_assign_pointer() for __rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists (np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer assignments instead of rcu_assign_pointer(): 1. In __ipv6_dev_mc_dec(), unlinking a group from idev->mc_list did: *map = ma->next; without rcu_assign_pointer() while concurrent readers traverse idev->mc_list locklessly under rcu_read_lock(). 2. In ipv6_sock_mc_drop() and __ipv6_sock_mc_close(), unlinking a group from np->ipv6_mc_list directly assigned *lnk = mc_lst->next and np->ipv6_mc_list = mc_lst->next without rcu_assign_pointer(), racing with lockless readers in inet6_mc_check(). 3. In __ipv6_sock_mc_join(), mc_lst->next was initialized to np->ipv6_mc_list via raw assignment before publishing mc_lst. 4. In mld_del_delrec() and __ipv6_dev_mc_inc(), __rcu source pointers passed into rcu_assign_pointer() lacked explicit dereference helpers. Fix these by consistently using rcu_assign_pointer() along with mc_dereference() / sock_dereference().
INFO
Published Date :
Sept. 25, 2026, 11:17 a.m.
Last Modified :
Oct. 28, 2026, 7:12 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Use rcu_assign_pointer() for RCU list updates.
- Use mc_dereference() for RCU pointers.
- Use sock_dereference() for RCU pointers.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-98099.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-98099 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-98099
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-98099 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-98099 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Oct. 28, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-362 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.2.7 *cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.114 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.57 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.38 up to (excluding) 6.6.160 Added Reference Type kernel.org: https://git.kernel.org/stable/c/0c8f56c583c3250408367880c98e4d6fbc929315 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/0e3e3cec28c4d1bf29948da40b4e9e5d44f7852b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6 Types: Patch Changed Reference Type nvd-ai-agent-0.4.0-gemma-4-31B-it: https://git.kernel.org/stable/c/0c8f56c583c3250408367880c98e4d6fbc929315 Types: Broken Link nvd-ai-agent-0.4.0-gemma-4-31B-it: https://git.kernel.org/stable/c/0c8f56c583c3250408367880c98e4d6fbc929315 Types: Broken Link, Patch Changed Reference Type nvd-ai-agent-0.4.0-gemma-4-31B-it: https://git.kernel.org/stable/c/2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6 Types: Broken Link nvd-ai-agent-0.4.0-gemma-4-31B-it: https://git.kernel.org/stable/c/2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6 Types: Broken Link, Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/49d7e1b456ba2f3ee08b3e264d999c09992cde8e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/afca229b39acc2590976b3e4f6e0fe76cededc60 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 21, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/98xxx/CVE-2026-98099.json">CVE-2026-98099</a> Added Reference https://git.kernel.org/stable/c/0e3e3cec28c4d1bf29948da40b4e9e5d44f7852b Added Reference https://git.kernel.org/stable/c/49d7e1b456ba2f3ee08b3e264d999c09992cde8e -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 19, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/98xxx/CVE-2026-98099.json">CVE-2026-98099</a> -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 15, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/98xxx/CVE-2026-98099.json">CVE-2026-98099</a> Added Reference https://git.kernel.org/stable/c/afca229b39acc2590976b3e4f6e0fe76cededc60 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 25, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu_assign_pointer() for __rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists (np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer assignments instead of rcu_assign_pointer(): 1. In __ipv6_dev_mc_dec(), unlinking a group from idev->mc_list did: *map = ma->next; without rcu_assign_pointer() while concurrent readers traverse idev->mc_list locklessly under rcu_read_lock(). 2. In ipv6_sock_mc_drop() and __ipv6_sock_mc_close(), unlinking a group from np->ipv6_mc_list directly assigned *lnk = mc_lst->next and np->ipv6_mc_list = mc_lst->next without rcu_assign_pointer(), racing with lockless readers in inet6_mc_check(). 3. In __ipv6_sock_mc_join(), mc_lst->next was initialized to np->ipv6_mc_list via raw assignment before publishing mc_lst. 4. In mld_del_delrec() and __ipv6_dev_mc_inc(), __rcu source pointers passed into rcu_assign_pointer() lacked explicit dereference helpers. Fix these by consistently using rcu_assign_pointer() along with mc_dereference() / sock_dereference(). Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/98xxx/CVE-2026-98099.json">CVE-2026-98099</a> Added Reference https://git.kernel.org/stable/c/0c8f56c583c3250408367880c98e4d6fbc929315 Added Reference https://git.kernel.org/stable/c/2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6