{"id":"CVE-2026-80995","summary":"net: mctp: hold a reference to the route device in mctp_route_lookup()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mctp: hold a reference to the route device in mctp_route_lookup()\n\nmctp_route_lookup() uses rt-\u003edev without holding a reference on it.\nmctp_route_lookup_single() returns the route under RCU only, so the\nroute's device can be torn down concurrently: mctp_dev_put() drops the\nlast reference and synchronously kfree()s mdev-\u003eaddrs.  mctp_dev_saddr()\nthen reads rt-\u003edev-\u003eaddrs[0], giving a use-after-free reachable by an\nunprivileged local AF_MCTP user on the receive/forwarding path (no\nCAP_NET_RAW required):\n\n  BUG: KASAN: slab-use-after-free in mctp_route_lookup\n  Read of size 1 at addr ... by task mctp_uaf/...\n   mctp_route_lookup\n   mctp_pkttype_receive\n  Freed by task ...:\n   kfree\n   mctp_dev_put\n   mctp_dev_notify\n\nIn the same window mctp_dst_from_route() -\u003e mctp_dev_hold() also\nincrements a refcount that has already reached zero\n(\"refcount_t: addition on 0 ... mctp_dev_hold\").\n\nThis reintroduces the use-after-free class of CVE-2023-3439: the source\naddress lookup was moved ahead of the point where the destination takes\nits device reference.\n\nTake a reference with refcount_inc_not_zero() before touching rt-\u003edev,\nskip a device that is already dead, and drop the reference once the\ndestination has taken its own.","modified":"2026-09-13T03:47:06.972561372Z","published":"2026-09-11T19:42:50.866Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80995.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/408da1df18116c971c3392e21e50586688cd3fbf"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cc561f8af25586300c2f9d285babb163b866b293"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80995.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80995"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"22cb45afd221b9e4f2a1dcc74a8ff645b7293aa1"},{"fixed":"cc561f8af25586300c2f9d285babb163b866b293"},{"fixed":"408da1df18116c971c3392e21e50586688cd3fbf"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80995.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80995.json"}}],"schema_version":"1.9.0"}