HIGH
ipv6 McastSource Race
CVE-2026-98102
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src() When removing a source filter whose count reaches zero, ip6_mc_del1_src() unlinks psf from pmc->mca_sources. If the filter was previously active, the code moved psf directly into pmc->mca_tomb by updating psf->sf_next. Because pmc->mca_sources is traversed locklessly under RCU (e.g. by ipv6_chk_mcast_addr()), mutating psf->sf_next before a grace period elapses diverts concurrent readers to the tombstone list. Consequently, readers miss remaining active sources in pmc->mca_sources and improperly examine deleted tombstone entries. Fix this by allocating a new tombstone node for pmc->mca_tomb (as done in sf_setstate()) and retiring the original psf via kfree_rcu().
02KernelScan AI Analysis
Risk summary
An unprivileged local user can trigger a race condition in the IPv6 multicast source filter list by joining and leaving multicast groups with source-specific filters. Concurrent RCU readers traversing the source list can be diverted to a tombstone list, leading to memory corruption, incorrect multicast filtering decisions, or kernel crash. Systems with IPv6 enabled and local untrusted users are at risk.
Vulnerability analysis
When a source filter is removed and its count reaches zero, the cleanup code repurposes the filter node by redirecting its next pointer into a separate tombstone list before the RCU grace period has elapsed. Concurrent readers traversing the active source list locklessly under RCU can follow this redirected pointer, missing remaining active sources and walking into tombstone entries that may subsequently be freed. The fix allocates a fresh node for the tombstone list instead of reusing the original, and retires the original node with kfree_rcu so it remains valid for the duration of any in-flight RCU read-side traversal. The vulnerable path is reachable by any local user who can create an IPv6 socket and manipulate multicast group source filters; no special privileges are required, and the race window depends on concurrent multicast traffic processing.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.10.261 | 5.11 | c3343cd7ec87 |
| 6.12 | — | 6.12.111 | 8d4fe5c13f50 |
| 6.18 | — | 6.18.53 | 5149c60c4065 |
| 6.6 | — | 6.6.158 | 4352737297b2 |
| 7.2 | — | 7.2.7 | 93b49239840b |
| mainline | — | 7.3 | — |
| cip/6.12 | — | 6.12.111-cip32 | 4352737297b2 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |