CVE-2026-43455
Analyzed Analyzed - Analysis Complete
Race Condition in Linux Kernel MCTP Routing

Publication date: 2026-05-08

Last updated on: 2026-05-20

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mctp: route: hold key->lock in mctp_flow_prepare_output() mctp_flow_prepare_output() checks key->dev and may call mctp_dev_set_key(), but it does not hold key->lock while doing so. mctp_dev_set_key() and mctp_dev_release_key() are annotated with __must_hold(&key->lock), so key->dev access is intended to be serialized by key->lock. The mctp_sendmsg() transmit path reaches mctp_flow_prepare_output() via mctp_local_output() -> mctp_dst_output() without holding key->lock, so the check-and-set sequence is racy. Example interleaving: CPU0 CPU1 ---- ---- mctp_flow_prepare_output(key, devA) if (!key->dev) // sees NULL mctp_flow_prepare_output( key, devB) if (!key->dev) // still NULL mctp_dev_set_key(devB, key) mctp_dev_hold(devB) key->dev = devB mctp_dev_set_key(devA, key) mctp_dev_hold(devA) key->dev = devA // overwrites devB Now both devA and devB references were acquired, but only the final key->dev value is tracked for release. One reference can be lost, causing a resource leak as mctp_dev_release_key() would only decrease the reference on one dev. Fix by taking key->lock around the key->dev check and mctp_dev_set_key() call.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-08
Last Modified
2026-05-20
Generated
2026-06-19
AI Q&A
2026-05-08
EPSS Evaluated
2026-06-18
NVD
CVE-2026-43455
EUVD
EUVD-2026-28761
Affected Vendors & Products
Showing 8 associated CPEs
Vendor Product Version / Range
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.2 (inc) to 6.6.130 (exc)
linux linux_kernel From 5.16 (inc) to 6.1.167 (exc)
linux linux_kernel From 6.13 (inc) to 6.18.19 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.78 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.9 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's MCTP (Management Component Transport Protocol) implementation, specifically in the function mctp_flow_prepare_output(). The function checks the key->dev pointer and may call mctp_dev_set_key(), but it does not hold the key->lock while doing so.

Because mctp_dev_set_key() and mctp_dev_release_key() require the key->lock to be held to serialize access to key->dev, the lack of locking in mctp_flow_prepare_output() creates a race condition. This means that two CPUs can simultaneously check and set key->dev without proper synchronization.

An example interleaving shows that two different devices (devA and devB) can both acquire references, but only the last set device is tracked for release. This causes one reference to be lost, leading to a resource leak.

The fix involves taking the key->lock around the check of key->dev and the call to mctp_dev_set_key() to ensure proper serialization and prevent the race condition.

Impact Analysis

This vulnerability can lead to a resource leak in the Linux kernel's MCTP implementation. Specifically, because of the race condition, one device reference may be lost and not properly released.

Resource leaks can degrade system performance over time, potentially leading to exhaustion of kernel resources, instability, or crashes if the leak is severe or persistent.

Mitigation Strategies

The vulnerability is caused by a race condition in the Linux kernel's mctp module where key->lock is not held during certain operations, leading to potential resource leaks.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version where this issue is fixed. The fix involves taking key->lock around the key->dev check and mctp_dev_set_key() call to prevent the race condition.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-43455. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart