CVE-2026-98099

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: use rcu_assign_pointer() for __rcu list updates

Several places in net/ipv6/mcast.c update RCU-protected lists

(np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer

assignments instead of rcu_assign_pointer():

1. In __ipv6_dev_mc_dec(), unlinking a group from idev->mc_list did:

*map = ma->next;

without rcu_assign_pointer() while concurrent readers traverse

idev->mc_list locklessly under rcu_read_lock().

2. In ipv6_sock_mc_drop() and __ipv6_sock_mc_close(), unlinking a group

from np->ipv6_mc_list directly assigned *lnk = mc_lst->next and

np->ipv6_mc_list = mc_lst->next without rcu_assign_pointer(), racing

with lockless readers in inet6_mc_check().

3. In __ipv6_sock_mc_join(), mc_lst->next was initialized to

np->ipv6_mc_list via raw assignment before publishing mc_lst.

4. In mld_del_delrec() and __ipv6_dev_mc_inc(), __rcu source pointers

passed into rcu_assign_po

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References