CVE-2026-43455

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mctp: route: hold key->lock in mctp_flow_prepare_output()

mctp_flow_prepare_output() checks key->dev and may call

mctp_dev_set_key(), but it does not hold key->lock while doing so.

mctp_dev_set_key() and mctp_dev_release_key() are annotated with

__must_hold(&key->lock), so key->dev access is intended to be

serialized by key->lock. The mctp_sendmsg() transmit path reaches

mctp_flow_prepare_output() via mctp_local_output() -> mctp_dst_output()

without holding key->lock, so the check-and-set sequence is racy.

Example interleaving:

CPU0 CPU1

---- ----

mctp_flow_prepare_output(key, devA)

if (!key->dev) // sees NULL

mctp_flow_prepare_output(

key, devB)

if (!key->dev) // still NULL

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References