Executive brief
A race condition vulnerability was identified in the Linux kernel's Management Component Transport Protocol (MCTP) implementation. MCTP is a protocol used for communication between different components within a computer system, such as between a CPU and a management controller. An attacker could exploit this flaw to cause a resource leak, potentially leading to system instability or a denial-of-service condition over time.
Technical details
A race condition exists in the MCTP routing component of the Linux kernel, specifically within the mctp_flow_prepare_output() function. The function checks and sets the key->dev field without properly holding the required key->lock, violating the serialization intended by the __must_hold(&key->lock) annotation. When multiple threads execute this path simultaneously (e.g., via mctp_sendmsg()), they may both observe a NULL key->dev, leading to multiple calls to mctp_dev_hold(). This results in one reference being overwritten and lost, causing a permanent resource leak. The vulnerability has been patched by ensuring the spinlock is held during the check-and-set sequence.
Affected products
- Linux Linux kernel 6.11, 6.6, 6.1, 5.15, 5.10
Timeline
- 2026-03-06: disclosed: Initial patch submission by Chengfeng Ye
- 2026-03-25: patched: Patch committed to stable trees by Greg Kroah-Hartman
- 2026-05-08: advisory: CVE-2026-43455 published
References
- https://git.kernel.org/stable/c/0695712f3a6f1a48915f95767cfb42077683dcdc
- https://git.kernel.org/stable/c/47893166bc5611ee9a20de6b8d2933b2320fb772
- https://git.kernel.org/stable/c/7d86aa41c073c4e7eb75fd2e674f1fd8f289728a
- https://git.kernel.org/stable/c/86f5334fcb48a5b611c33364ab52ca684d0f6d91
- https://git.kernel.org/stable/c/8d27d9b260dd19c1b519e1a13de6448f9984e30e
- https://git.kernel.org/stable/c/925a5ffd99cddd7a7e41d5ad120c7a2c6d50260f