CVE-2026-98103 - Vulnerability Details

- igmp: convert struct ip_sf_list to RCU

Description

In the Linux kernel, the following vulnerability has been resolved:

igmp: convert struct ip_sf_list to RCU

Commit 23d2b94043ca ("igmp: Add ip_mc_list lock in ip_check_mc_rcu")
added spin_lock_bh(&im->lock) to ip_check_mc_rcu() to prevent a
use-after-free while iterating im->sources during concurrent deletions.

However, ip_check_mc_rcu() is called from RCU read-side critical
sections in packet receive and route lookup fast paths (e.g.
__mkroute_output(), ip_route_input_rcu(), and __udp4_lib_rcv()).

When igmpv3_send_cr() or igmpv3_send_report() holds &pmc->lock and
calls add_grec() -> igmpv3_newpack() -> ip_route_output_ports(),
an XFRM policy matching a multicast destination triggers
xfrm_tmpl_resolve_one() -> xfrm4_get_saddr() -> __mkroute_output() ->
ip_check_mc_rcu(). This attempts to acquire &im->lock while &pmc->lock
is already held on the same CPU, triggering a lockdep recursive locking
warning / deadlock.

Fix this by converting IPv4 struct ip_sf_list to RCU, mirroring the
IPv6 implementation in net/ipv6/mcast.c:

1. Add struct rcu_head to struct ip_sf_list and annotate sf_next,
sources, and tomb as __rcu pointers.
2. Use rcu_assign_pointer() and kfree_rcu() for list updates and
deletions.
3. Remove spin_lock_bh(&im->lock) from ip_check_mc_rcu() and traverse
im->sources locklessly with for_each_psf_rcu(), reading and writing
counter fields with READ_ONCE() and WRITE_ONCE().

Note: RCU conversion of /proc/net/mcfilter will be done in a
separate patch.

Published: 2026-09-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel patch converts the IPv4 multicast source list from a spin‑lock protected structure into an RCU‑managed list. This change eliminates a use‑after‑free condition that could occur when iterating sources during concurrent deletions, and it removes the possibility of a recursive lockdep warning that could lead to a deadlock. The fix therefore protects the kernel against memory corruption and service disruption caused by malicious or malformed IGMP traffic.

Affected Systems

All Linux kernel releases that preceded the inclusion of commit 23d2b94043ca. The security advisory applies to any system running the kernel before the patch is applied. Vendor impact is limited to the generic Linux distribution kernel.

Risk and Exploitability

The CVSS score for this vulnerability is 5.5 and the EPSS score is < 1%. This vulnerability is not listed in the CISA KEV catalog. The risk is non‑zero because an attacker that can influence IGMP routing paths or trigger the specific sequence of calls outlined in the description could force the kernel to execute a potentially fatal use‑after‑free or deadlock, leading to a denial of service. The defect requires only that the vulnerable kernel be running; no additional privilege is required for exploitation. The likely attack vector is remote via the network stack, specifically by sending crafted IGMPv3 packets that activate the routing routine path that exercises ip_check_mc_rcu().

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`23d2b94043ca8835bd1e67749020e839f396a1c2`	affected	< f5182dfad54277267a8cb0c004a9cd4cf35aeebb
`23d2b94043ca8835bd1e67749020e839f396a1c2`	affected	< d3011d1f293478c730aa0870490afa145c37600e
`23d2b94043ca8835bd1e67749020e839f396a1c2`	affected	< e3206419bdb04e2087d8cc6be324df8639b3fac5
`23d2b94043ca8835bd1e67749020e839f396a1c2`	affected	< 2987ee196c88dbde0463dc87d5fb209c684e34a2
`b24065948ae6c48c9e20891f8cfe9850f1d748be`	affected	—
`e9924c4204ede999b0515fd31a370a1e27f676bc`	affected	—
`78967749984cf3614de346c90f3e259ff8272735`	affected	—
`4768973dffed4d0126854514335ed4fe87bec1ab`	affected	—
`d84708451d9041dff8a81e3718f821f12d2eb6c5`	affected	—
`ddd7e8b7b84836c584a284b98ca9bd7a348a0558`	affected	—
`961447ff60291b91e27d5c32fa549c1411ad3b70`	affected	—
`d1a3c6d5925a8d00a32c5ef2d674dd9c0ce89c95`	affected	—
`4.4.284`	affected	< 4.5
`4.9.283`	affected	< 4.10
`4.14.247`	affected	< 4.15
`4.19.207`	affected	< 4.20
`5.4.145`	affected	< 5.5
`5.10.64`	affected	< 5.11
`5.13.16`	affected	< 5.14
`5.14.3`	affected	< 5.15

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3-rc2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[23d2b94043ca8835bd1e67749020e839f396a1c2,f5182dfad54277267a8cb0c004a9cd4cf35aeebb)`	affected	code_commit	—
`[23d2b94043ca8835bd1e67749020e839f396a1c2,d3011d1f293478c730aa0870490afa145c37600e)`	affected	code_commit	—
`[23d2b94043ca8835bd1e67749020e839f396a1c2,e3206419bdb04e2087d8cc6be324df8639b3fac5)`	affected	code_commit	—
`[23d2b94043ca8835bd1e67749020e839f396a1c2,2987ee196c88dbde0463dc87d5fb209c684e34a2)`	affected	code_commit	—
`b24065948ae6c48c9e20891f8cfe9850f1d748be`	affected	code_commit	—
`e9924c4204ede999b0515fd31a370a1e27f676bc`	affected	code_commit	—
`78967749984cf3614de346c90f3e259ff8272735`	affected	code_commit	—
`4768973dffed4d0126854514335ed4fe87bec1ab`	affected	code_commit	—
`d84708451d9041dff8a81e3718f821f12d2eb6c5`	affected	code_commit	—
`ddd7e8b7b84836c584a284b98ca9bd7a348a0558`	affected	code_commit	—
`961447ff60291b91e27d5c32fa549c1411ad3b70`	affected	code_commit	—
`d1a3c6d5925a8d00a32c5ef2d674dd9c0ce89c95`	affected	code_commit	—
`[4.4.284,4.5)`	affected	semver	—
`[4.9.283,4.10)`	affected	semver	—
`[4.14.247,4.15)`	affected	semver	—
`[4.19.207,4.20)`	affected	semver	—
`[5.4.145,5.5)`	affected	semver	—
`[5.10.64,5.11)`	affected	semver	—
`[5.13.16,5.14)`	affected	semver	—
`[5.14.3,5.15)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	semver	—
`[0,5.15)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3-rc2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes commit 23d2b94043ca, which implements the RCU conversion and removes the spin‑lock protection on the multicast list.
Reboot the affected hosts to ensure the updated kernel is active and the new list semantics are engaged.
After the kernel reload, monitor system logs for lockdep warnings or deadlock messages. Persistent lockdep output may indicate that the upgrade has not fully applied or that other lock ordering issues exist.

Generated by OpenCVE AI on September 30, 2026 at 07:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98103.mbox
https://git.kernel.org/stable/c/2987ee196c88dbde0463dc87d5fb209c684e34a2
https://git.kernel.org/stable/c/d3011d1f293478c730aa0870490afa145c37600e
https://git.kernel.org/stable/c/e3206419bdb04e2087d8cc6be324df8639b3fac5
https://git.kernel.org/stable/c/f5182dfad54277267a8cb0c004a9cd4cf35aeebb
https://nvd.nist.gov/vuln/detail/CVE-2026-98103
https://www.cve.org/CVERecord?id=CVE-2026-98103

History

Tue, 29 Sep 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-764
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98103.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98103 https://www.cve.org/CVERecord?id=CVE-2026-98103
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 25 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: igmp: convert struct ip_sf_list to RCU Commit 23d2b94043ca ("igmp: Add ip_mc_list lock in ip_check_mc_rcu") added spin_lock_bh(&im->lock) to ip_check_mc_rcu() to prevent a use-after-free while iterating im->sources during concurrent deletions. However, ip_check_mc_rcu() is called from RCU read-side critical sections in packet receive and route lookup fast paths (e.g. __mkroute_output(), ip_route_input_rcu(), and __udp4_lib_rcv()). When igmpv3_send_cr() or igmpv3_send_report() holds &pmc->lock and calls add_grec() -> igmpv3_newpack() -> ip_route_output_ports(), an XFRM policy matching a multicast destination triggers xfrm_tmpl_resolve_one() -> xfrm4_get_saddr() -> __mkroute_output() -> ip_check_mc_rcu(). This attempts to acquire &im->lock while &pmc->lock is already held on the same CPU, triggering a lockdep recursive locking warning / deadlock. Fix this by converting IPv4 struct ip_sf_list to RCU, mirroring the IPv6 implementation in net/ipv6/mcast.c: 1. Add struct rcu_head to struct ip_sf_list and annotate sf_next, sources, and tomb as __rcu pointers. 2. Use rcu_assign_pointer() and kfree_rcu() for list updates and deletions. 3. Remove spin_lock_bh(&im->lock) from ip_check_mc_rcu() and traverse im->sources locklessly with for_each_psf_rcu(), reading and writing counter fields with READ_ONCE() and WRITE_ONCE(). Note: RCU conversion of /proc/net/mcfilter will be done in a separate patch.
Title		igmp: convert struct ip_sf_list to RCU
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2987ee196c88dbde0463dc87d5fb209c684e34a2 https://git.kernel.org/stable/c/d3011d1f293478c730aa0870490afa145c37600e https://git.kernel.org/stable/c/e3206419bdb04e2087d8cc6be324df8639b3fac5 https://git.kernel.org/stable/c/f5182dfad54277267a8cb0c004a9cd4cf35aeebb

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:35:53.942Z

Updated: 2026-09-25T10:35:53.942Z

Reserved: 2026-09-25T10:25:14.315Z

Link: CVE-2026-98103

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-09-25T11:17:40.613

Modified: 2026-09-30T14:10:59.253

Link: CVE-2026-98103

Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-98103 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-30T07:15:04Z

Weaknesses

CWE-764
Multiple Locks of a Critical Resource

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object