CVE-2026-98812
Received Received - Intake

Null Pointer Dereference in Linux Kernel MCTP Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctp_dev only after it is initialised mctp_add_dev() links the new mctp_dev into dev->mctp_ptr before mdev->dev is assigned, so a reader that picks the device up in that window dereferences a net_device pointer that is still NULL: KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7] Call Trace: <TASK> ? __pfx_mctp_sendmsg (./include/linux/sockptr.h:49) ? __pfx_mctp_dst_output (net/mctp/route.c:41) ? selinux_socket_sendmsg (security/selinux/hooks.c:5278) ____sys_sendmsg (net/socket.c:775 (discriminator 1) net/socket.c:790 (discriminator 1) net/socket.c:2684 (discriminator 1)) ? __pfx_____sys_sendmsg (net/socket.c:1131) ? __pfx_copy_msghdr_from_user (net/socket.c:2590) ? update_cfs_rq_load_avg (kernel/sched/fair.c:5478) ___sys_sendmsg (net/socket.c:2738) ? __pfx____sys_sendmsg (net/socket.c:2625) ? perf_event_task_tick (./include/linux/rcupdate.h:838) ? sched_tick (kernel/sched/core.c:5818) ? clockevents_program_event (kernel/time/clockevents.c:372) ? fdget (./include/linux/rcupdate.h:873 fs/file.c:1100) __sys_sendmsg (net/socket.c:2770) ? __pfx___sys_sendmsg (net/socket.c:2751) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK> Fix by publishing only once the object is fully initialised: __mctp_dev_get() runs under rcu_read_lock() only and hands this object to readers as soon as mctp_ptr is assigned, so they must never observe mdev->dev == NULL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98812
EUVD
EUVD-2026-103897

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 583be982d93479ea3d85091b0fd0b01201ede87d
Linux Linux 583be982d93479ea3d85091b0fd0b01201ede87d
Linux Linux 583be982d93479ea3d85091b0fd0b01201ede87d
Linux Linux 583be982d93479ea3d85091b0fd0b01201ede87d
Linux Linux 5.15

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a null pointer dereference vulnerability in the Linux kernel's MCTP (Management Component Transport Protocol) implementation. The issue occurs when mctp_add_dev() links a new mctp_dev into dev->mctp_ptr before mdev->dev is assigned, causing a race condition where a reader may access a NULL net_device pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's MCTP (Management Component Transport Protocol) implementation. Detection requires checking if your kernel version includes the affected code path. Use uname -a to check your kernel version and grep for MCTP-related modules or logs indicating null pointer dereferences in network operations.

Impact Analysis

This vulnerability could lead to kernel crashes or system instability due to null pointer dereference. Attackers might exploit it to cause denial-of-service conditions or potentially escalate privileges if they can trigger the vulnerable code path.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to ensure the fix for CVE-2026-98812 is included. If patches are unavailable, consider disabling MCTP functionality if not required, or restrict network operations involving MCTP until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98812. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart