CVE-2026-98102

A flaw was found in the Linux kernel's IPv6 multicast implementation. When removing an active multicast source filter, an internal list pointer is updated before the read-copy update (RCU) grace period elapses. A local user can exploit this race condition during concurrent multicast address lookups, causing readers to miss active sources and inspect deleted entries, potentially leading to incorrect network traffic filtering or a denial of service (DoS).

This vulnerability is rated as Moderate impact because exploitation requires local execution to alter IPv6 multicast group state, restricting the effect to denial of service or transient packet drop without exposing sensitive data or compromising system integrity. Red Hat Enterprise Linux 8 is not affected as the problematic code was introduced in subsequent kernel versions. On affected systems such as Red Hat Enterprise Linux 9 and Red Hat OpenShift, standard users can invoke the necessary socket options to trigger this synchronization flaw during concurrent network operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.