EUVD-2026-76318
GHSA-cvpj-275p-crg4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires precise timing (AC:H); local unprivileged access sufficient (PR:L, AV:L); full kernel impact once UAF exploited (C:H/I:H/A:H).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: mctp: hold a reference to the route device in mctp_route_lookup()
mctp_route_lookup() uses rt->dev without holding a reference on it. mctp_route_lookup_single() returns the route under RCU only, so the route's device can be torn down concurrently: mctp_dev_put() drops the last reference and synchronously kfree()s mdev->addrs. mctp_dev_saddr() then reads rt->dev->addrs[0], giving a use-after-free reachable by an unprivileged local AF_MCTP user on the receive/forwarding path (no CAP_NET_RAW required):
BUG: KASAN: slab-use-after-free in mctp_route_lookup Read of size 1 at addr ... by task mctp_uaf/... mctp_route_lookup mctp_pkttype_receive Freed by task ...: kfree mctp_dev_put mctp_dev_notify
In the same window mctp_dst_from_route() -> mctp_dev_hold() also increments a refcount that has already reached zero ("refcount_t: addition on 0 ... mctp_dev_hold").
This reintroduces the use-after-free class of CVE-2023-3439: the source address lookup was moved ahead of the point where the destination takes its device reference.
Take a reference with refcount_inc_not_zero() before touching rt->dev, skip a device that is already dead, and drop the reference once the destination has taken its own.
AnalysisAI
Use-after-free in the Linux kernel MCTP subsystem allows an unprivileged local user to corrupt kernel memory by racing mctp_route_lookup() against concurrent device teardown. The function accesses rt->dev without holding a reference, so mctp_dev_put() can kfree() mdev->addrs while mctp_saddr() is still reading rt->dev->addrs[0] - confirmed by a KASAN slab-use-after-free trace. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local unprivileged user access to the target system - no CAP_NET_RAW or any other capability is needed; (2) CONFIG_MCTP compiled into the kernel or loaded as a module (not a default configuration on most general-purpose distributions, but present on server/BMC-oriented builds); (3) at least one MCTP-capable network interface present and active so that routes and devices exist to race against; (4) ability to trigger or observe concurrent MCTP device teardown, which can occur through normal interface management without elevated privilege. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 rates this 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which is well-calibrated: local access and low privilege are the primary barriers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to Linux kernel 7.2.4 (stable) or 7.3-rc1 (mainline) which contain the fix via refcount_inc_not_zero() in mctp_route_lookup(). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, contact your Linux distribution vendor (Red Hat, Canonical, SUSE, etc.) to obtain specific patch versions for your deployed kernel versions and identify affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today