The Linux kernel kernel omits a reference count check when accessing the route device in mctp_route_lookup(), allowing the device to be freed while still being accessed. An unprivileged local user can trigger this flaw by sending specially crafted packets over the AF_MCTP protocol, causing a use-after-free that may result in kernel memory corruption, a crash, or potentially arbitrary code execution. The weakness is a classic use‑after‑free (CWE‑825).

This issue affects all Linux kernel builds that include the mctp networking code and that have not incorporated the recent commit that adds proper reference handling. The vendor is Linux; the product is the Linux kernel. No specific version numbers are supplied, but any kernel before the fix that contains the vulnerable code path is potentially vulnerable, so kernel changelogs or the vendor’s advisories should be consulted to determine exact version coverage.

The CVSS score of 4.7 indicates moderate severity, and the EPSS score is currently unavailable; the vulnerability is not listed in CISA’s KEV catalog. The exploit requires a local, unprivileged user with the ability to create AF_MCTP sockets, which is common in embedded or automotive system contexts. The attack path is straightforward: send a triggering packet that dereferences a freed device, producing a use‑after‑free that can crash the system or allow code execution. Because no special privileges are required, all users of the affected kernel are at risk if the flaw remains unfixed.