EUVD-2026-86929
GHSA-5fxh-xwwm-73v4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local unprivileged account
-
ExploitIssue concurrent IPv6 multicast join/leave syscalls
-
ExecutionWin race against lockless RCU list readers
-
ImpactCorrupt mc_list pointer and crash kernel (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a local attacker with an existing low-privileged account able to perform IPv6 multicast socket operations (joining/leaving groups via setsockopt on an IPv6 socket), on a kernel built with IPv6 support. The flaw is a race between these list-mutating operations and concurrent lockless RCU readers (e.g. inet6_mc_check / idev->mc_list traversal); the precise timing needed to win the race is what the CVSS AC:H reflects and is the primary limiting factor. Exploitation is strictly local - it cannot be reached over the network - and yields only a crash/denial of service, not code execution or data disclosure per the rated impact. The source commits indicate the issue dates back to around Linux 2.6.38 and is fixed in the branches listed by EUVD (patch 7.2.7 and 7.3-rc2); only kernels before the fix commits are affected. |
| Impact | This is a genuine but low-urgency defect. The supplied CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H, base 4.7 Medium) describes a locally-triggered, high-complexity flaw requiring an existing low-privileged account, with impact limited to availability (no confidentiality or integrity loss). All corroborating signals agree it is not a widespread threat: EPSS is 0.17% (6th percentile), there is no CISA KEV listing (not actively exploited), and no PoC or exploit reference appears in the input - only kernel.org patch commits. The vuln.today decision label is 'this_month', consistent with a patch-on-normal-cadence item rather than an emergency. The one conflicting signal is the 'Information Disclosure' tag, which contradicts the CVSS C:N/I:N rating: the actual bug is a data race (CWE-362) on RCU-protected IPv6 multicast lists whose rated impact is availability only (A:H, i.e. a kernel crash), so the Information Disclosure label should be treated with skepticism and verified. The AC:H and local-only vector mean reliable exploitation is difficult and cannot be performed remotely. |
| Exploit ScenarioDerived | A local user with an ordinary account rapidly performs IPv6 multicast join/leave socket operations while another CPU traverses the same RCU-protected lists locklessly. Winning the narrow race window causes a reader to observe an inconsistently published pointer, leading to memory corruption and a kernel crash (denial of service). No public exploit is available and the high attack complexity makes reliable triggering difficult. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Local low-privileged users can trigger a genuine but low-urgency race condition in the Linux kernel's IPv6 multicast list handling, causing a crash or denial of service on kernels built with IPv6 support. The defect affects kernels before the vendor fixes, traces back to approximately Linux 2.6.38, and is fixed in 7.2.7 and 7.3-rc2 per EUVD. No public exploit identified at time of analysis, EPSS is 0.17% (6th percentile), and the this_month priority label reflects limited, local-only, timing-dependent exposure.
RemediationAI
Vendor-released patch: update to Linux 7.2.7 or 7.3-rc2, or to a stable branch release that contains the fix commits 0c8f56c583c3250408367880c98e4d6fbc929315 and 2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6. The provided sources identify these as the fixed versions; kernels before the fix commits, including builds tracing back to about 2.6.38, remain affected. No vendor-documented workaround is provided, so the only complete remediation identified in the evidence is applying the patched kernel; because exploitation requires a local account able to perform IPv6 multicast socket operations, reducing untrusted local access or disabling IPv6 where it is not needed may limit exposure, with the trade-off that IPv6-dependent services will break, but neither is a substitute for the vendor fix. Patch references: https://git.kernel.org/stable/c/0c8f56c583c3250408367880c98e4d6fbc929315 and https://git.kernel.org/stable/c/2e46b0c9fcf7e10b64ce1630b925f47918d1f7f6.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is in net/ipv6/mcast.c, which maintains RCU-protected IPv6 multicast lists including np->ipv6_mc_list, idev->mc_list and idev->mc_tomb. Several unlink and initialization paths assigned list pointers directly instead of using rcu_assign_pointer(), and some __rcu source pointers lacked mc_dereference()/sock_dereference(); concurrent lockless readers traversing those lists under rcu_read_lock(), such as inet6_mc_check(), could therefore observe an improperly published update. This is CWE-362: the defect is a race between list-mutating socket operations and RCU readers, with the precise timing needed to win the race reflected by the AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H vector; the assessed impact is local crash/denial of service rather than code execution or data disclosure, and the Information Disclosure tag is not supported by the rated C:N/I:N impact. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the Linux kernel, and the source commits fix missing RCU publication ordering.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Local-only trigger (AV:L) needing an ordinary account (PR:L); exploitation depends on winning a narrow RCU race window (AC:H); impact is a kernel crash with no data exposure (C:N/I:N/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: use rcu_assign_pointer() for __rcu list updates
Several places in net/ipv6/mcast.c update RCU-protected lists (np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer assignments instead of rcu_assign_pointer():
- In __ipv6_dev_mc_dec(), unlinking a group from idev->mc_list did:
*map = ma->next; without rcu_assign_pointer() while concurrent readers traverse idev->mc_list locklessly under rcu_read_lock().
- In ipv6_sock_mc_drop() and __ipv6_sock_mc_close(), unlinking a group
from np->ipv6_mc_list directly assigned *lnk = mc_lst->next and np->ipv6_mc_list = mc_lst->next without rcu_assign_pointer(), racing with lockless readers in inet6_mc_check().
- In __ipv6_sock_mc_join(), mc_lst->next was initialized to
np->ipv6_mc_list via raw assignment before publishing mc_lst.
- In mld_del_delrec() and __ipv6_dev_mc_inc(), __rcu source pointers
passed into rcu_assign_pointer() lacked explicit dereference helpers.
Fix these by consistently using rcu_assign_pointer() along with mc_dereference() / sock_dereference().
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Exploit-DB