In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix RCU list...
zetlyn/cve-ghsa vulnerability ghsa GHSA-g228-xhf6-wqq6 cve CVE-2026-98102 known 2026-09-25
https://github.com/advisories/GHSA-g228-xhf6-wqq6
Properties
| severity | unknownreceipt
This source has not kept a receipt for this claim yet. The next update that reads it will. |
|---|
Text
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: fix RCU list...
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()
When removing a source filter whose count reaches zero, ip6_mc_del1_src()
unlinks psf from pmc->mca_sources. If the filter was previously active,
the code moved psf directly into pmc->mca_tomb by updating psf->sf_next.
Because pmc->mca_sources is traversed locklessly under RCU (e.g. by
ipv6_chk_mcast_addr()), mutating psf->sf_next before a grace period
elapses diverts concurrent readers to the tombstone list. Consequently,
readers miss remaining active sources in pmc->mca_sources and improperly
examine deleted tombstone entries.
Fix this by allocating a new tombstone node for pmc->mca_tomb (as done
in sf_setstate()) and retiring the original psf via kfree_rcu().