CVE-2026-80995

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: hold a reference to the route device in mctp_route_lookup()

mctp_route_lookup() uses rt->dev without holding a reference on it.

mctp_route_lookup_single() returns the route under RCU only, so the

route's device can be torn down concurrently: mctp_dev_put() drops the

last reference and synchronously kfree()s mdev->addrs. mctp_dev_saddr()

then reads rt->dev->addrs[0], giving a use-after-free reachable by an

unprivileged local AF_MCTP user on the receive/forwarding path (no

CAP_NET_RAW required):

BUG: KASAN: slab-use-after-free in mctp_route_lookup

Read of size 1 at addr ... by task mctp_uaf/...

mctp_route_lookup

mctp_pkttype_receive

Freed by task ...:

kfree

mctp_dev_put

mctp_dev_notify

In the same window mctp_dst_from_route() -> mctp_dev_hold() also

increments a refcount that has already reached zero

("refcount_t: addition on 0 ... mctp_dev_hold").

This reintroduces the use-after-fre

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References