---
id: "CVE-2026-98525"
kind: "vulnerability"
aliases: ["CVE-2026-98525"]
title: "Linux kernel MCTP: sockets can use other sockets' preallocated tags"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["bmc", "embedded", "infrastructure", "linux-kernel", "mctp"]
not_affected_if: ["mctp-not-loaded", "single-tenant-namespace"]
published_at: "2026-10-18T16:17:03+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:25:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98525", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel MCTP: sockets can use other sockets' preallocated tags

In the Linux kernel's MCTP route code, a socket sending with the prealloc tag flag could match tags reserved by any other MCTP socket in the same network namespace. The fix limits tag lookup to the sending socket's own tag list, so one socket can no longer consume another socket's preallocated tag.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` to see the running kernel version
- Check whether the MCTP stack is in use (`lsmod | grep mctp`); unknown whether this matters without MCTP sockets in use

## Fix

- Update the Linux kernel to a release that includes the upstream mctp route fix (fixed version: unknown)

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98525

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()

When a socket transmits a packet with MCTP_TAG_PREALLOC set,
mctp_lookup_prealloc_tag() iterates over the per-netns &mns->keys list
and matches netid, req_tag, peer_addr, and manual_alloc, without
checking whether tmp->sk == &msk->sk. This allows any MCTP socket in the
same network namespace to use and consume another socket's preallocated
tag.

Iterate the socket's own tag list (&msk->keys via sklist) instead of the
namespace-wide &mns->keys list in mctp_lookup_prealloc_tag(), ensuring
that only tags allocated by msk are matched.

Tested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag
(0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a
4-byte message with MCTP_TAG_PREALLOC from socket B in the same network
namespace. On the unfixed kernel, sendto(sock_b) using socket A's
preallocated tag succeeds (ret = 4); with this patch applied,
sendto(sock_b) fails with -ENOENT (errno = 2) while sendto(sock_a)
succeeds (ret = 4).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_