CVE-2026-80995 Overview
CVE-2026-80995 is a use-after-free vulnerability in the Linux kernel's Management Component Transport Protocol (MCTP) subsystem. The flaw resides in the mctp_route_lookup() function, which accesses rt->dev without holding a reference on the underlying device. An unprivileged local user with access to AF_MCTP sockets can trigger the condition on the receive or forwarding path, without requiring CAP_NET_RAW.
The issue reintroduces the use-after-free class previously tracked as CVE-2023-3439, where the source address lookup executes before the destination takes its device reference. Successful exploitation can lead to kernel memory corruption, information disclosure, or local privilege escalation.
Critical Impact
Unprivileged local users can trigger a kernel use-after-free through the MCTP receive path, enabling potential privilege escalation or kernel memory disclosure.
Affected Products
- Linux kernel branches containing the MCTP subsystem with the vulnerable mctp_route_lookup() implementation
- Distributions shipping affected upstream kernels prior to the fix commits 408da1df1811 and cc561f8af255
- Systems with AF_MCTP sockets exposed to unprivileged local users
Discovery Timeline
- 2026-09-11 - CVE-2026-80995 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-80995
Vulnerability Analysis
The MCTP subsystem implements routing for Management Component Transport Protocol packets between local applications and remote endpoints. The mctp_route_lookup() helper resolves a route and then dereferences rt->dev to determine the source address for an outbound or forwarded packet.
The helper mctp_route_lookup_single() returns the matching route under Read-Copy-Update (RCU) protection only. The device pointer stored on that route is not pinned by an additional reference count. When another CPU concurrently tears down the device, mctp_dev_put() drops the last reference and synchronously frees mdev->addrs through kfree().
A subsequent call to mctp_dev_saddr() reads rt->dev->addrs[0] after the memory has been freed. Kernel Address Sanitizer (KASAN) reports a slab-use-after-free of size 1 in mctp_route_lookup reached from mctp_pkttype_receive. The same race also triggers mctp_dst_from_route() to call mctp_dev_hold() on a device whose refcount already reached zero, producing a refcount_t: addition on 0 warning.
Root Cause
The root cause is missing reference counting on the route's device pointer during MCTP lookup [CWE-416: Use After Free]. RCU protection guarantees the route object remains valid for the duration of the read-side critical section, but it does not extend to the device linked from the route. When the device notifier path frees mdev->addrs concurrently, dereferences of rt->dev->addrs[0] operate on released slab memory.
Attack Vector
Exploitation requires local access and an unprivileged AF_MCTP socket. No CAP_NET_RAW capability is required. An attacker races MCTP packet reception or forwarding against MCTP device teardown, triggered through interface notifier events. The vulnerability is described in the upstream commits without a public proof-of-concept exploit at the time of publication. See the kernel commit 408da1df and kernel commit cc561f8a for the full fix.
// No verified proof-of-concept code is available.
// Refer to upstream commits for the fix and technical context.
Detection Methods for CVE-2026-80995
Indicators of Compromise
- KASAN reports of slab-use-after-free in mctp_route_lookup in kernel logs
- Kernel warnings containing refcount_t: addition on 0 originating from mctp_dev_hold
- Unexpected kernel oopses or panics with stack traces referencing mctp_pkttype_receive or mctp_dst_from_route
Detection Strategies
- Enable KASAN and refcount debugging on test kernels to surface concurrent free-and-use conditions in the MCTP path
- Audit systems for unprivileged processes opening AF_MCTP sockets when MCTP is not required by the workload
- Correlate kernel crash telemetry with MCTP device up/down events to identify race attempts
Monitoring Recommendations
- Forward kernel ring buffer messages and dmesg output to a centralized log platform for anomaly detection
- Alert on repeated kernel warnings referencing mctp_, refcount_t, or slab corruption
- Track process creation events that invoke socket(AF_MCTP, ...) on hosts without an MCTP workload
How to Mitigate CVE-2026-80995
Immediate Actions Required
- Apply the upstream fix commits 408da1df18116c971c3392e21e50586688cd3fbf and cc561f8af25586300c2f9d285babb163b866b293 or the distribution equivalent
- Restrict local shell access on systems that cannot be patched immediately
- Inventory hosts that load the mctp kernel module and prioritize patching for those exposed to multi-user access
Patch Information
The fix takes a reference with refcount_inc_not_zero() before touching rt->dev, skips devices that are already dead, and drops the reference after the destination has taken its own. The relevant upstream commits are 408da1df18116c971c3392e21e50586688cd3fbf and cc561f8af25586300c2f9d285babb163b866b293. Rebuild and deploy kernels containing these commits, then reboot affected hosts.
Workarounds
- Unload the mctp kernel module on systems that do not require MCTP functionality
- Blacklist the mctp module in /etc/modprobe.d/ to prevent auto-loading on reboot
- Use seccomp or LSM policies to block socket(AF_MCTP, ...) for untrusted user contexts
# Prevent the MCTP kernel module from loading
echo "blacklist mctp" | sudo tee /etc/modprobe.d/blacklist-mctp.conf
echo "install mctp /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-mctp.conf
sudo rmmod mctp 2>/dev/null || true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
