The Linux kernel bug allows a socket that sets MCTP_TAG_PREALLOC to reuse a preallocated tag belonging to another socket in the same network namespace. The kernel function mctp_lookup_prealloc_tag() walks a namespace‑wide list of tags without verifying that the socket being examined matches the calling socket, enabling one socket to consume a tag that was allocated for a different socket. This can lead to packets being sent under an unauthorized tag, effectively circumventing any isolation that the per‑socket preallocation was meant to provide.

Linux kernel versions before the patch that introduced the fix are vulnerable. The issue was observed in QEMU running Linux 7.3.0‑rc3; any kernel building with the mctp route code before that commit is at risk.

The flaw requires local code running in the same network namespace and the ability to open an MCTP socket, so the attack vector is local. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the exploit is straightforward: a malicious process can create an MCTP socket, enumerate the namespace’s keys, and send data using another socket’s tag, potentially breaching application level isolation.