GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80995 (GCVE-0-2026-80995)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-13 06:28
VLAI
Title
net: mctp: hold a reference to the route device in mctp_route_lookup()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctp_route_lookup() mctp_route_lookup() uses rt->dev without holding a reference on it. mctp_route_lookup_single() returns the route under RCU only, so the route's device can be torn down concurrently: mctp_dev_put() drops the last reference and synchronously kfree()s mdev->addrs. mctp_dev_saddr() then reads rt->dev->addrs[0], giving a use-after-free reachable by an unprivileged local AF_MCTP user on the receive/forwarding path (no CAP_NET_RAW required): BUG: KASAN: slab-use-after-free in mctp_route_lookup Read of size 1 at addr ... by task mctp_uaf/... mctp_route_lookup mctp_pkttype_receive Freed by task ...: kfree mctp_dev_put mctp_dev_notify In the same window mctp_dst_from_route() -> mctp_dev_hold() also increments a refcount that has already reached zero ("refcount_t: addition on 0 ... mctp_dev_hold"). This reintroduces the use-after-free class of CVE-2023-3439: the source address lookup was moved ahead of the point where the destination takes its device reference. Take a reference with refcount_inc_not_zero() before touching rt->dev, skip a device that is already dead, and drop the reference once the destination has taken its own.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 22cb45afd221b9e4f2a1dcc74a8ff645b7293aa1 , < cc561f8af25586300c2f9d285babb163b866b293 (git)
Affected: 22cb45afd221b9e4f2a1dcc74a8ff645b7293aa1 , < 408da1df18116c971c3392e21e50586688cd3fbf (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mctp/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc561f8af25586300c2f9d285babb163b866b293",
              "status": "affected",
              "version": "22cb45afd221b9e4f2a1dcc74a8ff645b7293aa1",
              "versionType": "git"
            },
            {
              "lessThan": "408da1df18116c971c3392e21e50586688cd3fbf",
              "status": "affected",
              "version": "22cb45afd221b9e4f2a1dcc74a8ff645b7293aa1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mctp/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mctp: hold a reference to the route device in mctp_route_lookup()\n\nmctp_route_lookup() uses rt-\u003edev without holding a reference on it.\nmctp_route_lookup_single() returns the route under RCU only, so the\nroute\u0027s device can be torn down concurrently: mctp_dev_put() drops the\nlast reference and synchronously kfree()s mdev-\u003eaddrs.  mctp_dev_saddr()\nthen reads rt-\u003edev-\u003eaddrs[0], giving a use-after-free reachable by an\nunprivileged local AF_MCTP user on the receive/forwarding path (no\nCAP_NET_RAW required):\n\n  BUG: KASAN: slab-use-after-free in mctp_route_lookup\n  Read of size 1 at addr ... by task mctp_uaf/...\n   mctp_route_lookup\n   mctp_pkttype_receive\n  Freed by task ...:\n   kfree\n   mctp_dev_put\n   mctp_dev_notify\n\nIn the same window mctp_dst_from_route() -\u003e mctp_dev_hold() also\nincrements a refcount that has already reached zero\n(\"refcount_t: addition on 0 ... mctp_dev_hold\").\n\nThis reintroduces the use-after-free class of CVE-2023-3439: the source\naddress lookup was moved ahead of the point where the destination takes\nits device reference.\n\nTake a reference with refcount_inc_not_zero() before touching rt-\u003edev,\nskip a device that is already dead, and drop the reference once the\ndestination has taken its own."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached when mctp_pkttype_receive() calls mctp_route_lookup() while the route device is destroyed via mctp_dev_notify()/NETDEV_UNREGISTER. An unprivileged local user can create a TUN (ARPHRD_NONE auto-attaches mctp_dev), inject ETH_P_MCTP frames, and delete that netdev; this is a local syscall/netlink path, not a remote IP service.\nAC:L - The attacker controls both sides of the race by injecting MCTP packets on one thread and unregistering the TUN/MCTP netdev on another, and can retry until mctp_dev_saddr() runs after mctp_dev_put() has synchronously kfree\u0027d mdev-\u003eaddrs.\nPR:L - TUN creation, MCTP address/route setup, and netdev teardown require CAP_NET_ADMIN, which an unprivileged user obtains in a user+net namespace. The receive/forwarding path has no CAP_NET_RAW check, unlike mctp_sendmsg().\nUI:N - Exploitation requires no victim action; the attacker alone creates the interface, injects frames, and tears it down.\nS:U - Impact is in-kernel use-after-free and local privilege escalation within the same kernel security authority; no VM escape, IOMMU bypass, or sandbox boundary is crossed.\nC:H - This is a use-after-free of mdev-\u003eaddrs (and a dangling mctp_dev after refcount-add-on-0); UAF of a kmalloc object enables heap reuse and arbitrary kernel memory disclosure.\nI:H - After the last reference is dropped, mctp_dst_from_route() still calls mctp_dev_hold() and later dst.output() uses the freed device; reclaiming that object yields an arbitrary write and control-flow hijack primitive.\nA:H - KASAN reports a slab-use-after-free in mctp_route_lookup and a refcount_t addition-on-0 in mctp_dev_hold; the UAF reliably oopses or panics the kernel even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:28:58.816Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc561f8af25586300c2f9d285babb163b866b293"
        },
        {
          "url": "https://git.kernel.org/stable/c/408da1df18116c971c3392e21e50586688cd3fbf"
        }
      ],
      "title": "net: mctp: hold a reference to the route device in mctp_route_lookup()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80995",
    "datePublished": "2026-09-11T19:42:50.866Z",
    "dateReserved": "2026-08-26T14:34:25.812Z",
    "dateUpdated": "2026-09-13T06:28:58.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80995",
      "date": "2026-09-15",
      "epss": "0.0012",
      "percentile": "0.02099"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80995\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:06.497\",\"lastModified\":\"2026-09-13T07:17:06.230\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: mctp: hold a reference to the route device in mctp_route_lookup()\\n\\nmctp_route_lookup() uses rt-\u003edev without holding a reference on it.\\nmctp_route_lookup_single() returns the route under RCU only, so the\\nroute\u0027s device can be torn down concurrently: mctp_dev_put() drops the\\nlast reference and synchronously kfree()s mdev-\u003eaddrs.  mctp_dev_saddr()\\nthen reads rt-\u003edev-\u003eaddrs[0], giving a use-after-free reachable by an\\nunprivileged local AF_MCTP user on the receive/forwarding path (no\\nCAP_NET_RAW required):\\n\\n  BUG: KASAN: slab-use-after-free in mctp_route_lookup\\n  Read of size 1 at addr ... by task mctp_uaf/...\\n   mctp_route_lookup\\n   mctp_pkttype_receive\\n  Freed by task ...:\\n   kfree\\n   mctp_dev_put\\n   mctp_dev_notify\\n\\nIn the same window mctp_dst_from_route() -\u003e mctp_dev_hold() also\\nincrements a refcount that has already reached zero\\n(\\\"refcount_t: addition on 0 ... mctp_dev_hold\\\").\\n\\nThis reintroduces the use-after-free class of CVE-2023-3439: the source\\naddress lookup was moved ahead of the point where the destination takes\\nits device reference.\\n\\nTake a reference with refcount_inc_not_zero() before touching rt-\u003edev,\\nskip a device that is already dead, and drop the reference once the\\ndestination has taken its own.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mctp/route.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"22cb45afd221b9e4f2a1dcc74a8ff645b7293aa1\",\"lessThan\":\"cc561f8af25586300c2f9d285babb163b866b293\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"22cb45afd221b9e4f2a1dcc74a8ff645b7293aa1\",\"lessThan\":\"408da1df18116c971c3392e21e50586688cd3fbf\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mctp/route.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/408da1df18116c971c3392e21e50586688cd3fbf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cc561f8af25586300c2f9d285babb163b866b293\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T20:16:15+00:00",
      "cve": "CVE-2026-80995",
      "id": "CVE-2026-80995",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: mctp: hold a reference to the route device in mctp_route_lookup()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80995.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:04:27Z",
      "cve": "CVE-2026-80995",
      "id": "CVE-2026-80995",
      "initial_release_date": "2026-09-12T16:36:00Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80995",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80995.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.