In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() When a socket… (CVE-2026-98525)

The vulnerability in the Linux kernel's MCTP route code involved the mctp_lookup_prealloc_tag() function iterating over the per-network namespace keys list (&mns->keys) and matching tags without verifying that the tag belonged to the socket performing the operation. This allowed any MCTP socket in the same network namespace to consume another socket's preallocated tag. The fix changes the iteration to use the socket's own tag list (&msk->keys via sklist), ensuring only tags allocated by that socket are matched. Testing on Linux kernel 7.3.0-rc3 confirmed that before the patch, a socket could send packets using another socket's preallocated tag, while after the patch, such attempts fail with -ENOENT.

An attacker controlling an MCTP socket in the same network namespace could misuse or consume preallocated tags belonging to other sockets, potentially disrupting communication or causing resource conflicts. There is no indication of privilege escalation or remote code execution. The impact is limited to tag misuse within the same network namespace.

A fix has been implemented in the Linux kernel to restrict tag iteration to the socket's own tag list, preventing cross-socket tag consumption. Users should update to a Linux kernel version that includes this patch. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.