CVE-2026-43455: Linux kernel · mctp: route: hold key->lock in mctp_flow_prepare_output()
Affects Linux kernelSource GCVE Database
Not known to be exploited.
Data as of 11 Nov 2026, 23:07 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
Thin evidence
One scorer or noneExploitation evidence
Disclosed: evidence found.
CVE published 8 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 11 Nov 2026.
Description
In the Linux kernel, the following vulnerability has been resolved: mctp: route: hold key->lock in mctp_flow_prepare_output() mctp_flow_prepare_output() checks key->dev and may call mctp_dev_set_key(), but it does not hold key->lock while doing so. mctp_dev_set_key() and mctp_dev_release_key() are annotated with __must_hold(&key->lock), so key->dev access is intended to be serialized by key->lock. The mctp_sendmsg() transmit path reaches mctp_flow_prepare_output() via mctp_local_output() -> mctp_dst_output() without holding key->lock, so the check-and-set sequence is racy. Example interleaving: CPU0 CPU1 ---- ---- mctp_flow_prepare_output(key, devA) if (!key->dev) // sees NULL mctp_flow_prepare_output( key, devB) if (!key->dev) // still NULL mctp_dev_set_key(devB, key) mctp_dev_hold(devB) key->dev = devB mctp_dev_set_key(devA, key) mctp_dev_hold(devA) key->dev = devA // overwrites devB Now both devA and devB references were acquired, but only the final key->dev value is tracked for release. One reference can be lost, causing a resource leak as mctp_dev_release_key() would only decrease the reference on one dev. Fix by taking key->lock around the key->dev check and mctp_dev_set_key() call.
References
- git.kernel.org/stable/c/47893166bc5611ee9a20de6b8d2933b2320fb772 (opens in a new tab)
- git.kernel.org/stable/c/86f5334fcb48a5b611c33364ab52ca684d0f6d91 (opens in a new tab)
- git.kernel.org/stable/c/0695712f3a6f1a48915f95767cfb42077683dcdc (opens in a new tab)
- git.kernel.org/stable/c/925a5ffd99cddd7a7e41d5ad120c7a2c6d50260f (opens in a new tab)
- git.kernel.org/stable/c/8d27d9b260dd19c1b519e1a13de6448f9984e30e (opens in a new tab)
- git.kernel.org/stable/c/7d86aa41c073c4e7eb75fd2e674f1fd8f289728a (opens in a new tab)