CVE-2026-98103

A moderate-impact denial-of-service flaw was found in the Linux kernel's IPv4 IGMP (Internet Group Management Protocol) implementation, affecting the kernel packages in Red Hat Enterprise Linux 8, 9, and 10 (including the Real Time kernel), Red Hat In-Vehicle OS, and the RHEL CoreOS images used by OpenShift Container Platform 4. When the kernel transmits IGMPv3 reports or source-filter change reports while holding a multicast lock, a route lookup for a multicast destination matched by an IPsec (XFRM) policy can re-enter the multicast membership check path on the same CPU and attempt to acquire a spinlock that is already held. This recursive locking causes a lockdep warning or a kernel deadlock that hangs the system, resulting in a local denial of service with no impact on confidentiality or integrity. Exploitation requires an uncommon, non-default configuration that combines an XFRM (IPsec) policy explicitly matching a multicast destination with active IGMPv3 multicast source-filter memberships, which limits practical exposure. Red Hat Enterprise Linux 7 (kernel and kernel-rt) and Red Hat Enterprise Linux 8.4 are not affected because the vulnerable code is not present in those streams. The upstream fix converts the IPv4 multicast source list to RCU (read-copy-update), mirroring the IPv6 implementation; this is a large and intrusive rework that is considered too risky to backport to the affected stable update streams, so the fix is deferred. The residual risk of deferral is a local denial of service (system hang) limited to systems configured with the specific multicast and IPsec conditions needed to trigger the deadlock.