CVE-2026-43455
Race Condition in Linux Kernel MCTP Routing
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | mctp | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's MCTP (Management Component Transport Protocol) implementation, specifically in the function mctp_flow_prepare_output(). The function checks the key->dev pointer and may call mctp_dev_set_key(), but it does not hold the key->lock while doing so.
Because mctp_dev_set_key() and mctp_dev_release_key() require the key->lock to be held to serialize access to key->dev, the lack of locking in mctp_flow_prepare_output() creates a race condition. This means that two CPUs can simultaneously check and set key->dev without proper synchronization.
An example interleaving shows that two different devices (devA and devB) can both acquire references, but only the last set device is tracked for release. This causes one reference to be lost, leading to a resource leak.
The fix involves taking the key->lock around the check of key->dev and the call to mctp_dev_set_key() to ensure proper serialization and prevent the race condition.
How can this vulnerability impact me? :
This vulnerability can lead to a resource leak in the Linux kernel's MCTP implementation. Specifically, because of the race condition, one device reference may be lost and not properly released.
Resource leaks can degrade system performance over time, potentially leading to exhaustion of kernel resources, instability, or crashes if the leak is severe or persistent.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by a race condition in the Linux kernel's mctp module where key->lock is not held during certain operations, leading to potential resource leaks.
To mitigate this vulnerability immediately, you should update your Linux kernel to a version where this issue is fixed. The fix involves taking key->lock around the key->dev check and mctp_dev_set_key() call to prevent the race condition.