CVE-2026-98525
Received Received - Intake

MCTP Tag Misuse in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() When a socket transmits a packet with MCTP_TAG_PREALLOC set, mctp_lookup_prealloc_tag() iterates over the per-netns &mns->keys list and matches netid, req_tag, peer_addr, and manual_alloc, without checking whether tmp->sk == &msk->sk. This allows any MCTP socket in the same network namespace to use and consume another socket's preallocated tag. Iterate the socket's own tag list (&msk->keys via sklist) instead of the namespace-wide &mns->keys list in mctp_lookup_prealloc_tag(), ensuring that only tags allocated by msk are matched. Tested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag (0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a 4-byte message with MCTP_TAG_PREALLOC from socket B in the same network namespace. On the unfixed kernel, sendto(sock_b) using socket A's preallocated tag succeeds (ret = 4); with this patch applied, sendto(sock_b) fails with -ENOENT (errno = 2) while sendto(sock_a) succeeds (ret = 4).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98525
EUVD
EUVD-2026-103570

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 63ed1aab3d40aa61aaa66819bdce9377ac7f40fa
Linux Linux 63ed1aab3d40aa61aaa66819bdce9377ac7f40fa
Linux Linux 63ed1aab3d40aa61aaa66819bdce9377ac7f40fa
Linux Linux 63ed1aab3d40aa61aaa66819bdce9377ac7f40fa
Linux Linux 5.18

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the MCTP (Management Component Transport Protocol) routing mechanism. When a socket sends a packet with a preallocated tag, the function mctp_lookup_prealloc_tag() incorrectly checks tags across all sockets in the network namespace instead of only the socket's own tags. This allows any socket in the same namespace to misuse another socket's preallocated tag.

Detection Guidance

This vulnerability affects the Linux kernel's MCTP (Management Component Transport Protocol) implementation. Detection requires checking if your kernel version is vulnerable and verifying if MCTP sockets are misusing preallocated tags. Examine kernel logs for MCTP-related errors or unexpected socket behavior. No specific commands are provided in the context.

Impact Analysis

An attacker in the same network namespace could exploit this to send unauthorized messages using another socket's preallocated tag. This could lead to data corruption, unauthorized access, or denial of service by consuming resources or interfering with legitimate communications.

Mitigation Strategies

Apply the kernel patch that modifies mctp_lookup_prealloc_tag() to iterate the socket's own tag list instead of the namespace-wide list. Update to a fixed Linux kernel version if available. Restrict network namespace access to untrusted users to limit exploitation scope.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98525. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart