---
id: CVE-2026-98102
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()

  When removing a source filter whose count reaches zero, ip6_mc_del1_src()
  unlinks psf from pmc->mca_sources
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()

  When removing a source filter whose count reaches zero, ip6_mc_del1_src()
  unlinks psf from pmc->mca_sources. I…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4b200e398953c237c86d32bf26d4cb2a96556a6f <
    4352737297b262e8367675c19a7dc6a9f53c97af
  - >-
    Linux >= 4b200e398953c237c86d32bf26d4cb2a96556a6f <
    8d4fe5c13f5056faa6deb09a90e24a89f9ebfad4
  - >-
    Linux >= 4b200e398953c237c86d32bf26d4cb2a96556a6f <
    5149c60c406595b56fda0c6e9aae7fd287f636aa
  - >-
    Linux >= 4b200e398953c237c86d32bf26d4cb2a96556a6f <
    93b49239840b91313adbd77b8b52993eff2d08c1
  - Linux 86c49119f0353f857cc08030ec9e4ebaab3d5a64
  - Linux >= 5.10.261 < 5.11
  - Linux 5.13
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:39.943'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98102'
references:
  - url: 'https://git.kernel.org/stable/c/4352737297b262e8367675c19a7dc6a9f53c97af'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5149c60c406595b56fda0c6e9aae7fd287f636aa'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8d4fe5c13f5056faa6deb09a90e24a89f9ebfad4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/93b49239840b91313adbd77b8b52993eff2d08c1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.826Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()

When removing a source filter whose count reaches zero, ip6_mc_del1_src()
unlinks psf from pmc->mca_sources. If the filter was previously active,
the code moved psf directly into pmc->mca_tomb by updating psf->sf_next.

Because pmc->mca_sources is traversed locklessly under RCU (e.g. by
ipv6_chk_mcast_addr()), mutating psf->sf_next before a grace period
elapses diverts concurrent readers to the tombstone list. Consequently,
readers miss remaining active sources in pmc->mca_sources and improperly
examine deleted tombstone entries.

Fix this by allocating a new tombstone node for pmc->mca_tomb (as done
in sf_setstate()) and retiring the original psf via kfree_rcu().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.