A race condition exists in the Linux kernel’s MCTP routing subsystem. In mctp_flow_prepare_output(), the code checks whether key->dev is set and, if not, calls mctp_dev_set_key() to associate a device with the key. However, that callback requires key->lock to be held, and the calling function does not hold that lock. If two threads interleave, both can set the key on different devices, causing the second set to overwrite the first and leading to a lost reference. This race corresponds to a race condition flaw (CWE-367) and can result in a reference leak of one device. Over time, leaked references may exhaust kernel resources, causing instability or a denial of service.

The vulnerability affects any Linux kernel build that contains the MCTP route module and has not yet applied the patch that protects the key->dev check with the lock. This includes all unpatched releases prior to the commit that adds the missing key lock. The impact is confined to the kernel and does not depend on specific hardware beyond those that use MCTP traffic.

The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation. The attack vector requires an internal race within the kernel, so remote exploitation is unlikely without additional local privilege or process interference. Environments with heavy MCTP traffic that invoke concurrent send operations are more likely to trigger the race, potentially leading to silent reference leaks and eventual kernel instability.