Linux Kernel MCTP key->dev lock race leads to resource leak
CVE-2026-43455 Published on May 8, 2026
mctp: route: hold key->lock in mctp_flow_prepare_output()
In the Linux kernel, the following vulnerability has been resolved:
mctp: route: hold key->lock in mctp_flow_prepare_output()
mctp_flow_prepare_output() checks key->dev and may call
mctp_dev_set_key(), but it does not hold key->lock while doing so.
mctp_dev_set_key() and mctp_dev_release_key() are annotated with
__must_hold(&key->lock), so key->dev access is intended to be
serialized by key->lock. The mctp_sendmsg() transmit path reaches
mctp_flow_prepare_output() via mctp_local_output() -> mctp_dst_output()
without holding key->lock, so the check-and-set sequence is racy.
Example interleaving:
CPU0 CPU1
---- ----
mctp_flow_prepare_output(key, devA)
if (!key->dev) // sees NULL
mctp_flow_prepare_output(
key, devB)
if (!key->dev) // still NULL
mctp_dev_set_key(devB, key)
mctp_dev_hold(devB)
key->dev = devB
mctp_dev_set_key(devA, key)
mctp_dev_hold(devA)
key->dev = devA // overwrites devB
Now both devA and devB references were acquired, but only the final
key->dev value is tracked for release. One reference can be lost,
causing a resource leak as mctp_dev_release_key() would only decrease
the reference on one dev.
Fix by taking key->lock around the key->dev check and
mctp_dev_set_key() call.
Products Associated with CVE-2026-43455
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 67737c457281dd199ceb9e31b6ba7efd3bfe566d and below 47893166bc5611ee9a20de6b8d2933b2320fb772 is affected.
- Version 67737c457281dd199ceb9e31b6ba7efd3bfe566d and below 86f5334fcb48a5b611c33364ab52ca684d0f6d91 is affected.
- Version 67737c457281dd199ceb9e31b6ba7efd3bfe566d and below 0695712f3a6f1a48915f95767cfb42077683dcdc is affected.
- Version 67737c457281dd199ceb9e31b6ba7efd3bfe566d and below 925a5ffd99cddd7a7e41d5ad120c7a2c6d50260f is affected.
- Version 67737c457281dd199ceb9e31b6ba7efd3bfe566d and below 8d27d9b260dd19c1b519e1a13de6448f9984e30e is affected.
- Version 67737c457281dd199ceb9e31b6ba7efd3bfe566d and below 7d86aa41c073c4e7eb75fd2e674f1fd8f289728a is affected.
- Version 5.16 is affected.
- Before 5.16 is unaffected.
- Version 6.1.167, <= 6.1.* is unaffected.
- Version 6.6.130, <= 6.6.* is unaffected.
- Version 6.12.78, <= 6.12.* is unaffected.
- Version 6.18.19, <= 6.18.* is unaffected.
- Version 6.19.9, <= 6.19.* is unaffected.
- Version 7.0, <= * is unaffected.