CVE-2026-98812
Description
In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctp_dev only after it is initialised mctp_add_dev() links the new mctp_dev into dev->mctp_ptr before mdev->dev is assigned, so a reader that picks the device up in that window dereferences a net_device pointer that is still NULL: KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7] Call Trace: <TASK> ? __pfx_mctp_sendmsg (./include/linux/sockptr.h:49) ? __pfx_mctp_dst_output (net/mctp/route.c:41) ? selinux_socket_sendmsg (security/selinux/hooks.c:5278) ____sys_sendmsg (net/socket.c:775 (discriminator 1) net/socket.c:790 (discriminator 1) net/socket.c:2684 (discriminator 1)) ? __pfx_____sys_sendmsg (net/socket.c:1131) ? __pfx_copy_msghdr_from_user (net/socket.c:2590) ? update_cfs_rq_load_avg (kernel/sched/fair.c:5478) ___sys_sendmsg (net/socket.c:2738) ? __pfx____sys_sendmsg (net/socket.c:2625) ? perf_event_task_tick (./include/linux/rcupdate.h:838) ? sched_tick (kernel/sched/core.c:5818) ? clockevents_program_event (kernel/time/clockevents.c:372) ? fdget (./include/linux/rcupdate.h:873 fs/file.c:1100) __sys_sendmsg (net/socket.c:2770) ? __pfx___sys_sendmsg (net/socket.c:2751) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK> Fix by publishing only once the object is fully initialised: __mctp_dev_get() runs under rcu_read_lock() only and hands this object to readers as soon as mctp_ptr is assigned, so they must never observe mdev->dev == NULL.
How to fix
- Linux Linux58a270b5ecd8629114a4754d642bad6a33bef493, fdf09d0fa2fb639950bede185d22689f68df140e, 288ef37e0c463192dbb6436e61cdc07ce666dcb9, af6e4f931afc2d670d133aa2bedc8b6e3753c618, 63120572edde85bb2b70b0ed4d4817ed52247613, f37f42e6e039a48c2dcf6c079b9f7fbc864ab7ef, aadf655e8ea9a8ffa24bb8d69f504572e8d18181 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 583be982d93479ea3d85091b0fd0b01201ede87d ≤ v < 58a270b5ecd8629114a4754d642bad6a33bef493, 583be982d93479ea3d85091b0fd0b01201ede87d ≤ v < fdf09d0fa2fb639950bede185d22689f68df140e, 583be982d93479ea3d85091b0fd0b01201ede87d ≤ v < 288ef37e0c463192dbb6436e61cdc07ce666dcb9, 583be982d93479ea3d85091b0fd0b01201ede87d ≤ v < af6e4f931afc2d670d133aa2bedc8b6e3753c618, 583be982d93479ea3d85091b0fd0b01201ede87d ≤ v < 63120572edde85bb2b70b0ed4d4817ed52247613, 583be982d93479ea3d85091b0fd0b01201ede87d ≤ v < f37f42e6e039a48c2dcf6c079b9f7fbc864ab7ef, 583be982d93479ea3d85091b0fd0b01201ede87d ≤ v < aadf655e8ea9a8ffa24bb8d69f504572e8d18181, 5.15 | 58a270b5ecd8629114a4754d642bad6a33bef493, fdf09d0fa2fb639950bede185d22689f68df140e, 288ef37e0c463192dbb6436e61cdc07ce666dcb9, af6e4f931afc2d670d133aa2bedc8b6e3753c618, 63120572edde85bb2b70b0ed4d4817ed52247613, f37f42e6e039a48c2dcf6c079b9f7fbc864ab7ef, aadf655e8ea9a8ffa24bb8d69f504572e8d18181 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.