CVE-2026-80995

Received Received - Intake

Use-After-Free in Linux Kernel MCTP Stack

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctp_route_lookup() mctp_route_lookup() uses rt->dev without holding a reference on it. mctp_route_lookup_single() returns the route under RCU only, so the route's device can be torn down concurrently: mctp_dev_put() drops the last reference and synchronously kfree()s mdev->addrs. mctp_dev_saddr() then reads rt->dev->addrs[0], giving a use-after-free reachable by an unprivileged local AF_MCTP user on the receive/forwarding path (no CAP_NET_RAW required): BUG: KASAN: slab-use-after-free in mctp_route_lookup Read of size 1 at addr ... by task mctp_uaf/... mctp_route_lookup mctp_pkttype_receive Freed by task ...: kfree mctp_dev_put mctp_dev_notify In the same window mctp_dst_from_route() -> mctp_dev_hold() also increments a refcount that has already reached zero ("refcount_t: addition on 0 ... mctp_dev_hold"). This reintroduces the use-after-free class of CVE-2023-3439: the source address lookup was moved ahead of the point where the destination takes its device reference. Take a reference with refcount_inc_not_zero() before touching rt->dev, skip a device that is already dead, and drop the reference once the destination has taken its own.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-80995

EUVD

EUVD-2026-76318

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's MCTP (Management Component Transport Protocol) implementation. It occurs in the mctp_route_lookup() function where a reference to a network device is used without being held, allowing the device to be freed while still being accessed. This leads to a use-after-free condition exploitable by an unprivileged local user.

Detection Guidance

This vulnerability is specific to the Linux kernel's MCTP (Management Component Transport Protocol) implementation. Detection requires checking kernel logs for KASAN (Kernel Address Sanitizer) reports indicating slab-use-after-free in mctp_route_lookup. Monitor for crashes or errors in kernel logs related to AF_MCTP operations. No direct commands are provided in the context to detect this issue.

Impact Analysis

An attacker with local access could exploit this to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. The vulnerability requires no special capabilities like CAP_NET_RAW, making it accessible to any local user.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's MCTP (Management Component Transport Protocol) implementation. It does not directly relate to data protection or privacy standards like GDPR or HIPAA, as it involves a kernel memory corruption flaw rather than data exposure or unauthorized access. Compliance impact would depend on whether the affected system processes or stores regulated data, but the vulnerability itself is not a direct violation of these standards.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a kernel version that includes the fix for CVE-2026-80995. If immediate patching is not possible, restrict access to AF_MCTP sockets by unprivileged users or disable MCTP functionality until the patch is applied.

Hi! I’m here to help you understand CVE-2026-80995. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70