The Linux kernel's mctp_route_lookup() function used the route device pointer (rt->dev) without holding a proper reference, causing a use-after-free when the device could be concurrently torn down. Specifically, mctp_route_lookup_single() returns the route under RCU protection only, but the device reference was not held, allowing mctp_dev_put() to free the device while it was still accessed. This leads to a use-after-free and refcount underflow in mctp_dev_hold(). The vulnerability affects unprivileged local AF_MCTP users on the receive/forwarding path without requiring CAP_NET_RAW privileges. The fix involves taking a reference with refcount_inc_not_zero() before accessing rt->dev, skipping dead devices, and dropping the reference after the destination device reference is taken.

An unprivileged local user can exploit this vulnerability to cause a use-after-free condition in kernel memory, potentially leading to memory corruption or kernel crashes. The flaw affects the MCTP networking code and does not require elevated capabilities, increasing the risk of local privilege escalation or denial of service. However, no known exploits are reported in the wild at this time.

A fix has been implemented in the Linux kernel to properly hold a reference to the route device in mctp_route_lookup() using refcount_inc_not_zero(), skipping devices that are already dead, and releasing the reference appropriately. Users should update to the fixed kernel version once available. Patch status is not yet confirmed in this data; check the official Linux kernel advisories for the specific fixed versions and remediation guidance.