CVE-2026-80995

The Linux kernel's MCTP (Management Component Transport Protocol) route-lookup path dereferences a route's underlying network device without holding a reference, so the device can be torn down and freed concurrently (mctp_dev_put() kfree's mdev->addrs) while mctp_dev_saddr() reads rt->dev->addrs[0] and mctp_dst_from_route() increments an already-zero refcount. An unprivileged local user with access to an AF_MCTP socket — no CAP_NET_RAW required — can trigger this use-after-free on the receive/forwarding path, potentially escalating privileges to root or crashing the kernel (CVSS 3.1: 7.8, with high confidentiality, integrity, and availability impact). This regresses the same bug class as CVE-2023-3439 because the source-address lookup was moved ahead of the point where the destination takes its device reference. Affected systems are those running kernel builds containing the regressed MCTP code; the fix takes a refcount_inc_not_zero() reference on the device, skips devices that are already dead, and drops the reference once the destination holds its own. No public PoC is known, the CVE is not in CISA's KEV, and no exploitation in the wild has been reported.

What to do: Patch to a kernel containing the upstream fix that takes a device reference with refcount_inc_not_zero() in mctp_route_lookup() and skips already-dead devices. If patching is delayed, check whether the mctp module is loaded or MCTP interfaces/routes exist and unload or disable AF_MCTP where it is not needed. On systems where MCTP is in use, restrict untrusted local user accounts, since exploitation requires only an unprivileged local AF_MCTP socket and no CAP_NET_RAW.