CVE-2026-98103 Linux CVE debrief

Who should care

Linux kernel maintainers and users should assess exposure and verify patch deployment to prevent potential lockdep recursive locking warnings or deadlocks and use-after-free vulnerability. Linux kernel maintainers and users are advised to review and apply the patch to convert struct ip_sf_list to RCU. Additionally, Linux kernel maintainers and users should monitor for potential lockdep recursive locking warnings or deadlocks and review compensating

Why it matters

Linux kernel maintainers and users should assess exposure and verify patch deployment to prevent potential lockdep recursive locking warnings or deadlocks and use-after-free vulnerability.

• Potential lockdep recursive locking warnings or deadlocks.
• Use-after-free vulnerability in Linux kernel.
• Patch deployment and verification required.

Technical summary

The Linux kernel vulnerability was caused by a use-after-free while iterating im->sources during concurrent deletions. The fix converts struct ip_sf_list to RCU, mirroring the IPv6 implementation in net/ipv6/mcast.c. This change was necessary to ensure the stability and security of Linux kernel systems. The conversion to RCU was done by adding struct rcu_head to struct ip_sf_list and annotating sf_next, sources, and tomb as __rcu pointers. Additionally, rcu_assign_pointer() and kfree_rcu() are used for list updates and deletions.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify patch deployment.

Recommended defensive actions

• Assess exposure and verify patch deployment for Linux kernel systems.
• Review and apply the patch to convert struct ip_sf_list to RCU.
• Monitor for potential lockdep recursive locking warnings or deadlocks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the Linux kernel vulnerability and its resolution. The vulnerability was caused by a use-after-free while iterating im->sources during concurrent deletions. The fix converts struct ip_sf_list to RCU, mirroring the IPv6 implementation. This change was necessary to ensure the stability and security of Linux kernel systems. The conversion to RCU was done by adding struct rcu_head to struct ip_sf_list and annotating sf_next, sources, and tomb as __rcu pointers. The CVE record was published

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.