HIGH Introduced in 7.1
mctp RouteLookup UAF
CVE-2026-80995
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.3HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctp_route_lookup() mctp_route_lookup() uses rt->dev without holding a reference on it. mctp_route_lookup_single() returns the route under RCU only, so the route's device can be torn down concurrently: mctp_dev_put() drops the last reference and synchronously kfree()s mdev->addrs. mctp_dev_saddr() then reads rt->dev->addrs[0], giving a use-after-free reachable by an unprivileged local AF_MCTP user on the receive/forwarding path (no CAP_NET_RAW required): BUG: KASAN: slab-use-after-free in mctp_route_lookup Read of size 1 at addr ... by task mctp_uaf/... mctp_route_lookup mctp_pkttype_receive Freed by task ...: kfree mctp_dev_put mctp_dev_notify In the same window mctp_dst_from_route() -> mctp_dev_hold() also increments a refcount that has already reached zero ("refcount_t: addition on 0 ... mctp_dev_hold"). This reintroduces the use-after-free class of CVE-2023-3439: the source address lookup was moved ahead of the point where the destination takes its device reference. Take a reference with refcount_inc_not_zero() before touching rt->dev, skip a device that is already dead, and drop the reference once the destination has taken its own.
02KernelScan AI Analysis
Risk summary
An unprivileged local user with access to an AF_MCTP socket can trigger a use-after-free in the MCTP route lookup path by racing device teardown against route lookup. This can lead to kernel memory disclosure, memory corruption, or a kernel panic. Systems running the MCTP subsystem with local untrusted users or multi-tenant workloads are at highest risk.
Vulnerability analysis
The MCTP route lookup function accesses a route's underlying network device without holding a reference to it. Because the route is returned only under RCU protection, another thread can concurrently tear down that device—freeing its address array while the lookup path is still reading from it, producing a use-after-free. The same race window also causes a refcount increment on an already-freed device. The fix takes a reference on the device before any access using an operation that refuses to resurrect an already-dead device, skips routes whose device is gone, and releases the reference once the destination structure has taken its own. The bug is reachable by any unprivileged local user with an AF_MCTP socket on the receive or forwarding path, requiring no special capabilities, though exploitation depends on winning a narrow race window between device teardown and route lookup.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.1 | 7.2.4 | cc561f8af255 |
| mainline | 7.1 | 7.3 | 408da1df1811 |