CVE-2026-80995

Status: UPDATED  |  Advisory ID: CVE-2026-80995

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: hold a reference to the route device in mctp_route_lookup()

mctp_route_lookup() uses rt->dev without holding a reference on it.

mctp_route_lookup_single() returns the route under RCU only, so the

route's device can be torn down concurrently: mctp_dev_put() drops the

last reference and synchronously kfree()s mdev->addrs. mctp_dev_saddr()

then reads rt->dev->addrs[0], giving a use-after-free reachable by an

unprivileged local AF_MCTP user on the receive/forwarding path (no

CAP_NET_RAW required):

BUG: KASAN: slab-use-after-free in mctp_route_lookup

Read of size 1 at addr ... by task mctp_uaf/...

mctp_route_lookup

mctp_pkttype_receive

Freed by task ...:

kfree

mctp_dev_put

mctp_dev_notify

In the same window mctp_dst_from_route() -> mctp_dev_hold() also

increments a refcount that has already reached zero

("refcount_t: addition on 0 ... mctp_dev_hold").

This reintroduces the use-after-free class of CVE-2023-3439: the source

address lookup was moved ahead of the point where the destination takes

its device reference.

Take a reference with refcount_inc_not_zero() before touching rt->dev,

skip a device that is already dead, and drop the reference once the

destination has taken its own. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References