Live › vulnerability › CVE-2026-98525
Go to dashboardIn the Linux kernel's MCTP route code, a socket sending with the prealloc tag flag could match tags reserved by any other MCTP socket in the same network namespace. The fix limits tag lookup to the sending socket's own tag list, so one socket can no longer consume another socket's preallocated tag.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems that load the MCTP protocol and open MCTP sockets can be affected, and the issue matters mainly where several local users or services share a network namespace. The sources do not give affected kernel version ranges. Systems without MCTP support or use can skip it.
No product ranges from the sources yet.
uname -r to see the running kernel versionlsmod | grep mctp); unknown whether this matters without MCTP sockets in useEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
When a socket transmits a packet with MCTP_TAG_PREALLOC set, mctp_lookup_prealloc_tag() iterates over the per-netns &mns->keys list and matches netid, req_tag, peer_addr, and manual_alloc, without checking whether tmp->sk == &msk->sk. This allows any MCTP socket in the same network namespace to use and consume another socket's preallocated tag.
Iterate the socket's own tag list (&msk->keys via sklist) instead of the namespace-wide &mns->keys list in mctp_lookup_prealloc_tag(), ensuring that only tags allocated by msk are matched.
Tested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag (0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a 4-byte message with MCTP_TAG_PREALLOC from socket B in the same network namespace. On the unfixed kernel, sendto(sock_b) using socket A's preallocated tag succeeds (ret = 4); with this patch applied, sendto(sock_b) fails with -ENOENT (errno = 2) while sendto(sock_a) succeeds (ret = 4).
This page as .md · .json · in your agent: get_signal("CVE-2026-98525")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.