CVE-2026-98103

A flaw was found in the Linux kernel's Internet Group Management Protocol (IGMP) subsystem. A recursive locking condition can occur when transmitting IGMPv3 reports over network routes configured with IPsec (Internet Protocol Security) policies, as the kernel attempts to acquire a spinlock that is already held on the same CPU. An attacker capable of triggering these multicast routing conditions can induce a kernel deadlock, leading to a system freeze and denial of service (DoS).

A moderate-impact denial-of-service flaw was found in the Linux kernel's IPv4 IGMP (Internet Group Management Protocol) implementation, affecting the kernel packages in Red Hat Enterprise Linux 8, 9, and 10 (including the Real Time kernel), Red Hat In-Vehicle OS, and the RHEL CoreOS images used by OpenShift Container Platform 4. When the kernel transmits IGMPv3 reports or source-filter change reports while holding a multicast lock, a route lookup for a multicast destination matched by an IPsec (XFRM) policy can re-enter the multicast membership check path on the same CPU and attempt to acquire a spinlock that is already held. This recursive locking causes a lockdep warning or a kernel deadlock that hangs the system, resulting in a local denial of service with no impact on confidentiality or integrity. Exploitation requires an uncommon, non-default configuration that combines an XFRM (IPsec) policy explicitly matching a multicast destination with active IGMPv3 multicast source-filter memberships, which limits practical exposure. Red Hat Enterprise Linux 7 (kernel and kernel-rt) and Red Hat Enterprise Linux 8.4 are not affected because the vulnerable code is not present in those streams. The upstream fix converts the IPv4 multicast source list to RCU (read-copy-update), mirroring the IPv6 implementation; this is a large and intrusive rework that is considered too risky to backport to the affected stable update streams, so the fix is deferred. The residual risk of deferral is a local denial of service (system hang) limited to systems configured with the specific multicast and IPsec conditions needed to trigger the deadlock.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.