CVE-2026-98812: Linux Kernel MCTP Use-After-Free Vulnerability

CVE-2026-98812 Overview

CVE-2026-98812 is a null pointer dereference vulnerability in the Linux kernel's Management Component Transport Protocol (MCTP) networking subsystem. The flaw resides in the mctp_add_dev() function in net/mctp/, which links a new mctp_dev into dev->mctp_ptr before the mdev->dev field is assigned. A concurrent reader traversing the device under rcu_read_lock() can observe the partially initialized object and dereference a net_device pointer that is still NULL. Kernel sanitizers report the issue as KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7]. The vulnerability has been resolved upstream.

Critical Impact
A local user able to send MCTP messages during device setup can trigger a kernel null pointer dereference, resulting in a denial of service through kernel panic.

Affected Products

Linux kernel versions containing the vulnerable mctp_add_dev() publication ordering
Systems with the MCTP networking subsystem (CONFIG_MCTP) enabled
Distributions shipping stable kernels prior to the fix commits referenced below

Discovery Timeline

2026-10-18 - CVE-2026-98812 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98812

Vulnerability Analysis

The Management Component Transport Protocol (MCTP) subsystem registers per-interface state through an mctp_dev structure attached to a net_device via the mctp_ptr field. In mctp_add_dev(), the kernel assigned dev->mctp_ptr to the new mctp_dev before fully initializing the structure, specifically before setting mdev->dev to the owning net_device.

Because __mctp_dev_get() runs under rcu_read_lock() only, any reader that observes the pointer during this window receives an object whose dev member is still NULL. Subsequent code paths such as mctp_sendmsg() and mctp_dst_output() dereference mdev->dev, triggering a kernel null pointer dereference confirmed by KASAN at offset 0xb0.

Root Cause

The root cause is an initialization ordering bug combined with RCU publication semantics. Publishing an object through an RCU-protected pointer must happen only after all fields observable to readers are fully initialized. The vulnerable code violated this invariant by exposing the mctp_dev before assigning mdev->dev.

Attack Vector

Exploitation requires local access with the ability to send MCTP messages while an MCTP-capable interface is being brought up. A process invoking sendmsg() on an MCTP socket during the narrow registration window can reach mctp_sendmsg() and dereference the uninitialized pointer, panicking the kernel. The attack is a race condition and is not remotely reachable without existing MCTP connectivity.

The upstream fix reorders initialization so that mdev->dev is assigned before dev->mctp_ptr is published, ensuring readers never observe a NULL device pointer. See the kernel patch commits 288ef37e, 63120572, aadf655e, af6e4f93, and f37f42e6 for technical details.

Detection Methods for CVE-2026-98812

Indicators of Compromise

Kernel oops or panic messages containing null-ptr-deref in call traces that reference mctp_sendmsg or mctp_dst_output.
KASAN reports showing null pointer access in the range [0x00000000000000b0-0x00000000000000b7] originating from the MCTP code path.
Unexpected reboots on hosts that use MCTP for baseboard management or hardware telemetry.

Detection Strategies

Audit running kernel versions against the stable trees that contain the referenced fix commits.
Review system journals (journalctl -k) and /var/log/kern.log for crash signatures involving mctp_add_dev, mctp_ptr, or __mctp_dev_get.
Enable KASAN on test kernels to deterministically catch the dereference during MCTP interface registration.

Monitoring Recommendations

Forward kernel ring buffer events to a centralized log store and alert on repeated MCTP-related oops entries.
Track MCTP interface creation and teardown events to correlate crashes with device state transitions.
Monitor process behavior for unprivileged workloads opening AF_MCTP sockets on hosts where MCTP is not expected.

How to Mitigate CVE-2026-98812

Immediate Actions Required

Apply the upstream Linux kernel patches listed in the external references and reboot affected hosts.
Inventory systems with CONFIG_MCTP enabled and prioritize those exposed to local untrusted users or workloads.
Restrict access to AF_MCTP sockets where MCTP functionality is not required for operational use.

Patch Information

The fix is distributed across the Linux stable trees in commits 288ef37e, 63120572, aadf655e, af6e4f93, and f37f42e6. The patch reorders field assignment so that mdev->dev is initialized before dev->mctp_ptr is published to RCU readers. Consume the fix through your Linux distribution's security update channel once available.

Workarounds

Disable the MCTP module on systems that do not require it by blacklisting the mctp kernel module.
Restrict permissions on MCTP network interface creation using appropriate CAP_NET_ADMIN controls.
Avoid dynamic creation and destruction of MCTP interfaces on production hosts until the kernel is patched.

bash

# Prevent the MCTP module from loading on hosts that do not need it
echo "install mctp /bin/true" | sudo tee /etc/modprobe.d/disable-mctp.conf
sudo rmmod mctp 2>/dev/null || true