CVE-2026-98103

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

igmp: convert struct ip_sf_list to RCU

Commit 23d2b94043ca ("igmp: Add ip_mc_list lock in ip_check_mc_rcu")

added spin_lock_bh(&im->lock) to ip_check_mc_rcu() to prevent a

use-after-free while iterating im->sources during concurrent deletions.

However, ip_check_mc_rcu() is called from RCU read-side critical

sections in packet receive and route lookup fast paths (e.g.

__mkroute_output(), ip_route_input_rcu(), and __udp4_lib_rcv()).

When igmpv3_send_cr() or igmpv3_send_report() holds &pmc->lock and

calls add_grec() -> igmpv3_newpack() -> ip_route_output_ports(),

an XFRM policy matching a multicast destination triggers

xfrm_tmpl_resolve_one() -> xfrm4_get_saddr() -> __mkroute_output() ->

ip_check_mc_rcu(). This attempts to acquire &im->lock while &pmc->lock

is already held on the same CPU, triggering a lockdep recursive locking

warning / deadlock.

Fix this by converting IPv4 struct ip_sf_list to RCU, mirroring the

IP

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References