A race condition exists in the MCTP routing subsystem of the Linux kernel. When preparing an outgoing message, the code checks if a key is already bound to a device and, if not, calls a function that must be protected by a lock. Because the calling code does not hold that lock, two threads can concurrently perform the check and set operations on different devices. The second thread overwrites the first key assignment, causing one device reference to be lost. The lost reference cannot be released, leading to a leaking reference counter. Over time this leak could exhaust kernel resources, destabilize the system, or trigger a denial of service.

The issue affects any Linux kernel that includes the MCTP routing module and has not yet incorporated the missing lock around the key check. All unpatched releases with this module remain vulnerable. The problem is limited to the kernel and does not rely on specific hardware; any device that uses MCTP traffic could trigger the race.

The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation. The attack vector requires an internal race within the kernel, so remote exploitation is unlikely unless the attacker can induce simultaneous MCTP operations. Heavy MCTP traffic or deliberate concurrency could trigger the race, potentially leading to silent reference leaks and eventual kernel instability. The CVSS score of 5.5 reflects moderate severity.