CVE-2026-98103 - Vulnerability Details

- igmp: convert struct ip_sf_list to RCU

Description

In the Linux kernel, the following vulnerability has been resolved:

igmp: convert struct ip_sf_list to RCU

Commit 23d2b94043ca ("igmp: Add ip_mc_list lock in ip_check_mc_rcu")
added spin_lock_bh(&im->lock) to ip_check_mc_rcu() to prevent a
use-after-free while iterating im->sources during concurrent deletions.

However, ip_check_mc_rcu() is called from RCU read-side critical
sections in packet receive and route lookup fast paths (e.g.
__mkroute_output(), ip_route_input_rcu(), and __udp4_lib_rcv()).

When igmpv3_send_cr() or igmpv3_send_report() holds &pmc->lock and
calls add_grec() -> igmpv3_newpack() -> ip_route_output_ports(),
an XFRM policy matching a multicast destination triggers
xfrm_tmpl_resolve_one() -> xfrm4_get_saddr() -> __mkroute_output() ->
ip_check_mc_rcu(). This attempts to acquire &im->lock while &pmc->lock
is already held on the same CPU, triggering a lockdep recursive locking
warning / deadlock.

Fix this by converting IPv4 struct ip_sf_list to RCU, mirroring the
IPv6 implementation in net/ipv6/mcast.c:

1. Add struct rcu_head to struct ip_sf_list and annotate sf_next,
sources, and tomb as __rcu pointers.
2. Use rcu_assign_pointer() and kfree_rcu() for list updates and
deletions.
3. Remove spin_lock_bh(&im->lock) from ip_check_mc_rcu() and traverse
im->sources locklessly with for_each_psf_rcu(), reading and writing
counter fields with READ_ONCE() and WRITE_ONCE().

Note: RCU conversion of /proc/net/mcfilter will be done in a
separate patch.

Published: 2026-09-25

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel patch converts the IPv4 multicast source list from a spin‑lock protected structure into an RCU‑managed list. This change eliminates a use‑after‑free condition that could occur when iterating sources during concurrent deletions, and it removes the possibility of a recursive lockdep warning that could lead to a deadlock. The fix therefore protects the kernel against memory corruption and service disruption caused by malicious or malformed IGMP traffic.

Affected Systems

All Linux kernel releases that preceded the inclusion of commit 23d2b94043ca (the change that adds ip_mc_list locking and RCU conversion). The security advisory applies to any system running the kernel before the patch is applied. Vendor impact is limited to the generic Linux distribution kernel.

Risk and Exploitability

No CVSS score or EPSS information is available for this vulnerability, and it is not listed in the CISA KEV catalog. However, the risk is non‑zero because an attacker that can influence IGMP routing paths or trigger the specific sequence of calls outlined in the description could force the kernel to execute a potentially fatal use‑after‑free or deadlock, leading to a denial of service. The defect requires only that the vulnerable kernel be running; no additional privilege is required for exploitation. The attack vector is inferred to be remote via the network stack, specifically by sending crafted IGMPv3 packets that activate the routing routine path that exercises ip_check_mc_rcu().

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`23d2b94043ca8835bd1e67749020e839f396a1c2`	affected	< f5182dfad54277267a8cb0c004a9cd4cf35aeebb
`23d2b94043ca8835bd1e67749020e839f396a1c2`	affected	< d3011d1f293478c730aa0870490afa145c37600e
`23d2b94043ca8835bd1e67749020e839f396a1c2`	affected	< e3206419bdb04e2087d8cc6be324df8639b3fac5
`23d2b94043ca8835bd1e67749020e839f396a1c2`	affected	< 2987ee196c88dbde0463dc87d5fb209c684e34a2
`b24065948ae6c48c9e20891f8cfe9850f1d748be`	affected	—
`e9924c4204ede999b0515fd31a370a1e27f676bc`	affected	—
`78967749984cf3614de346c90f3e259ff8272735`	affected	—
`4768973dffed4d0126854514335ed4fe87bec1ab`	affected	—
`d84708451d9041dff8a81e3718f821f12d2eb6c5`	affected	—
`ddd7e8b7b84836c584a284b98ca9bd7a348a0558`	affected	—
`961447ff60291b91e27d5c32fa549c1411ad3b70`	affected	—
`d1a3c6d5925a8d00a32c5ef2d674dd9c0ce89c95`	affected	—
`4.4.284`	affected	< 4.5
`4.9.283`	affected	< 4.10
`4.14.247`	affected	< 4.15
`4.19.207`	affected	< 4.20
`5.4.145`	affected	< 5.5
`5.10.64`	affected	< 5.11
`5.13.16`	affected	< 5.14
`5.14.3`	affected	< 5.15

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3-rc2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[23d2b94043ca8835bd1e67749020e839f396a1c2,f5182dfad54277267a8cb0c004a9cd4cf35aeebb)`	affected	code_commit	—
`[23d2b94043ca8835bd1e67749020e839f396a1c2,d3011d1f293478c730aa0870490afa145c37600e)`	affected	code_commit	—
`[23d2b94043ca8835bd1e67749020e839f396a1c2,e3206419bdb04e2087d8cc6be324df8639b3fac5)`	affected	code_commit	—
`[23d2b94043ca8835bd1e67749020e839f396a1c2,2987ee196c88dbde0463dc87d5fb209c684e34a2)`	affected	code_commit	—
`b24065948ae6c48c9e20891f8cfe9850f1d748be`	affected	code_commit	—
`e9924c4204ede999b0515fd31a370a1e27f676bc`	affected	code_commit	—
`78967749984cf3614de346c90f3e259ff8272735`	affected	code_commit	—
`4768973dffed4d0126854514335ed4fe87bec1ab`	affected	code_commit	—
`d84708451d9041dff8a81e3718f821f12d2eb6c5`	affected	code_commit	—
`ddd7e8b7b84836c584a284b98ca9bd7a348a0558`	affected	code_commit	—
`961447ff60291b91e27d5c32fa549c1411ad3b70`	affected	code_commit	—
`d1a3c6d5925a8d00a32c5ef2d674dd9c0ce89c95`	affected	code_commit	—
`[4.4.284,4.5)`	affected	semver	—
`[4.9.283,4.10)`	affected	semver	—
`[4.14.247,4.15)`	affected	semver	—
`[4.19.207,4.20)`	affected	semver	—
`[5.4.145,5.5)`	affected	semver	—
`[5.10.64,5.11)`	affected	semver	—
`[5.13.16,5.14)`	affected	semver	—
`[5.14.3,5.15)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	semver	—
`[0,5.15)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3-rc2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes commit 23d2b94043ca, which implements the RCU conversion and removes the spin‑lock protection on the multicast list.
Reboot the affected hosts to ensure the updated kernel is active and the new list semantics are engaged.
After the kernel reload, monitor system logs for lockdep warnings or deadlock messages. Persistent lockdep output may indicate that the upgrade has not fully applied or that other lock ordering issues exist.

Generated by OpenCVE AI on September 25, 2026 at 11:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2987ee196c88dbde0463dc87d5fb209c684e34a2
https://git.kernel.org/stable/c/d3011d1f293478c730aa0870490afa145c37600e
https://git.kernel.org/stable/c/e3206419bdb04e2087d8cc6be324df8639b3fac5
https://git.kernel.org/stable/c/f5182dfad54277267a8cb0c004a9cd4cf35aeebb

History

Fri, 25 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: igmp: convert struct ip_sf_list to RCU Commit 23d2b94043ca ("igmp: Add ip_mc_list lock in ip_check_mc_rcu") added spin_lock_bh(&im->lock) to ip_check_mc_rcu() to prevent a use-after-free while iterating im->sources during concurrent deletions. However, ip_check_mc_rcu() is called from RCU read-side critical sections in packet receive and route lookup fast paths (e.g. __mkroute_output(), ip_route_input_rcu(), and __udp4_lib_rcv()). When igmpv3_send_cr() or igmpv3_send_report() holds &pmc->lock and calls add_grec() -> igmpv3_newpack() -> ip_route_output_ports(), an XFRM policy matching a multicast destination triggers xfrm_tmpl_resolve_one() -> xfrm4_get_saddr() -> __mkroute_output() -> ip_check_mc_rcu(). This attempts to acquire &im->lock while &pmc->lock is already held on the same CPU, triggering a lockdep recursive locking warning / deadlock. Fix this by converting IPv4 struct ip_sf_list to RCU, mirroring the IPv6 implementation in net/ipv6/mcast.c: 1. Add struct rcu_head to struct ip_sf_list and annotate sf_next, sources, and tomb as __rcu pointers. 2. Use rcu_assign_pointer() and kfree_rcu() for list updates and deletions. 3. Remove spin_lock_bh(&im->lock) from ip_check_mc_rcu() and traverse im->sources locklessly with for_each_psf_rcu(), reading and writing counter fields with READ_ONCE() and WRITE_ONCE(). Note: RCU conversion of /proc/net/mcfilter will be done in a separate patch.
Title		igmp: convert struct ip_sf_list to RCU
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2987ee196c88dbde0463dc87d5fb209c684e34a2 https://git.kernel.org/stable/c/d3011d1f293478c730aa0870490afa145c37600e https://git.kernel.org/stable/c/e3206419bdb04e2087d8cc6be324df8639b3fac5 https://git.kernel.org/stable/c/f5182dfad54277267a8cb0c004a9cd4cf35aeebb

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:35:53.942Z

Updated: 2026-09-25T10:35:53.942Z

Reserved: 2026-09-25T10:25:14.315Z

Link: CVE-2026-98103

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:40.613

Modified: 2026-09-25T11:17:40.613

Link: CVE-2026-98103

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-25T13:45:18Z

Weaknesses

No weakness.

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object