mctp: route: hold key->lock in mctp_flow_prepare_output()
Summary
| CVE | CVE-2026-43455 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-05-08 15:16:58 UTC |
| Updated | 2026-05-08 15:16:58 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: mctp: route: hold key->lock in mctp_flow_prepare_output() mctp_flow_prepare_output() checks key->dev and may call mctp_dev_set_key(), but it does not hold key->lock while doing so. mctp_dev_set_key() and mctp_dev_release_key() are annotated with __must_hold(&key->lock), so key->dev access is intended to be serialized by key->lock. The mctp_sendmsg() transmit path reaches mctp_flow_prepare_output() via mctp_local_output() -> mctp_dst_output() without holding key->lock, so the check-and-set sequence is racy. Example interleaving: CPU0 CPU1 ---- ---- mctp_flow_prepare_output(key, devA) if (!key->dev) // sees NULL mctp_flow_prepare_output( key, devB) if (!key->dev) // still NULL mctp_dev_set_key(devB, key) mctp_dev_hold(devB) key->dev = devB mctp_dev_set_key(devA, key) mctp_dev_hold(devA) key->dev = devA // overwrites devB Now both devA and devB references were acquired, but only the final key->dev value is tracked for release. One reference can be lost, causing a resource leak as mctp_dev_release_key() would only decrease the reference on one dev. Fix by taking key->lock around the key->dev check and mctp_dev_set_key() call. |
Risk And Classification
EPSS: 0.000240000 probability, percentile 0.070210000 (date 2026-05-11)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 67737c457281dd199ceb9e31b6ba7efd3bfe566d 47893166bc5611ee9a20de6b8d2933b2320fb772 git | Not specified |
| CNA | Linux | Linux | affected 67737c457281dd199ceb9e31b6ba7efd3bfe566d 86f5334fcb48a5b611c33364ab52ca684d0f6d91 git | Not specified |
| CNA | Linux | Linux | affected 67737c457281dd199ceb9e31b6ba7efd3bfe566d 0695712f3a6f1a48915f95767cfb42077683dcdc git | Not specified |
| CNA | Linux | Linux | affected 67737c457281dd199ceb9e31b6ba7efd3bfe566d 925a5ffd99cddd7a7e41d5ad120c7a2c6d50260f git | Not specified |
| CNA | Linux | Linux | affected 67737c457281dd199ceb9e31b6ba7efd3bfe566d 8d27d9b260dd19c1b519e1a13de6448f9984e30e git | Not specified |
| CNA | Linux | Linux | affected 67737c457281dd199ceb9e31b6ba7efd3bfe566d 7d86aa41c073c4e7eb75fd2e674f1fd8f289728a git | Not specified |
| CNA | Linux | Linux | affected 5.16 | Not specified |
| CNA | Linux | Linux | unaffected 5.16 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.167 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.130 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.78 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.19 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.19.9 6.19.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.0 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/0695712f3a6f1a48915f95767cfb42077683dcdc | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/47893166bc5611ee9a20de6b8d2933b2320fb772 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/86f5334fcb48a5b611c33364ab52ca684d0f6d91 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/925a5ffd99cddd7a7e41d5ad120c7a2c6d50260f | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/7d86aa41c073c4e7eb75fd2e674f1fd8f289728a | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/8d27d9b260dd19c1b519e1a13de6448f9984e30e | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.