CVE-2026-98812 - Vulnerability Details

- net/mctp: publish the mctp_dev only after it is initialised

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mctp: publish the mctp_dev only after it is initialised

mctp_add_dev() links the new mctp_dev into dev->mctp_ptr before mdev->dev
is assigned, so a reader that picks the device up in that window
dereferences a net_device pointer that is still NULL:

KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7]
Call Trace:
<TASK>
? __pfx_mctp_sendmsg (./include/linux/sockptr.h:49)
? __pfx_mctp_dst_output (net/mctp/route.c:41)
? selinux_socket_sendmsg (security/selinux/hooks.c:5278)
____sys_sendmsg (net/socket.c:775 (discriminator 1) net/socket.c:790
(discriminator 1) net/socket.c:2684 (discriminator 1))
? __pfx_____sys_sendmsg (net/socket.c:1131)
? __pfx_copy_msghdr_from_user (net/socket.c:2590)
? update_cfs_rq_load_avg (kernel/sched/fair.c:5478)
___sys_sendmsg (net/socket.c:2738)
? __pfx____sys_sendmsg (net/socket.c:2625)
? perf_event_task_tick (./include/linux/rcupdate.h:838)
? sched_tick (kernel/sched/core.c:5818)
? clockevents_program_event (kernel/time/clockevents.c:372)
? fdget (./include/linux/rcupdate.h:873 fs/file.c:1100)
__sys_sendmsg (net/socket.c:2770)
? __pfx___sys_sendmsg (net/socket.c:2751)
do_syscall_64 (arch/x86/entry/syscall_64.c:63)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
</TASK>

Fix by publishing only once the object is fully initialised:
__mctp_dev_get() runs under rcu_read_lock() only and hands
this object to readers as soon as mctp_ptr is assigned, so
they must never observe mdev->dev == NULL.

Published: 2026-10-18

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vendor supplied commit fixes an issue in the Linux kernel’s net/mctp driver where a newly created mctp_dev is linked into the device list before its internal net_device pointer is fully initialized. This race condition allows a reader to observe a NULL net_device pointer during the narrow window where the pointer has not yet been assigned, triggering a kernel null‑pointer dereference that is caught by KASAN and results in a kernel crash. The crash brings the entire system down, constituting a denial‑of‑service fault that affects all users of the affected kernel.

Affected Systems

All Linux kernel builds that include the legacy net/mctp implementation before the commit that publishes the device only after full initialization are affected. The affected product is the Linux kernel; specific version ranges are not supplied and the bug is present in any kernel containing the problematic code until the patch is applied.

Risk and Exploitability

The CVSS score of 5.5 indicates a moderate severity. Based on the description, the likely attack vector is a local user able to construct or send data on an mctp socket that has not yet been fully initialized; this triggers the crash. The EPSS score of <1% shows a very low but non‑zero exploitation probability, and the vulnerability is not listed in CISA KEV. The impact is a non‑reversible denial of service that can disrupt system operations if exploited.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`583be982d93479ea3d85091b0fd0b01201ede87d`	affected	< 58a270b5ecd8629114a4754d642bad6a33bef493
`583be982d93479ea3d85091b0fd0b01201ede87d`	affected	< fdf09d0fa2fb639950bede185d22689f68df140e
`583be982d93479ea3d85091b0fd0b01201ede87d`	affected	< 288ef37e0c463192dbb6436e61cdc07ce666dcb9
`583be982d93479ea3d85091b0fd0b01201ede87d`	affected	< af6e4f931afc2d670d133aa2bedc8b6e3753c618
`583be982d93479ea3d85091b0fd0b01201ede87d`	affected	< 63120572edde85bb2b70b0ed4d4817ed52247613
`583be982d93479ea3d85091b0fd0b01201ede87d`	affected	< f37f42e6e039a48c2dcf6c079b9f7fbc864ab7ef
`583be982d93479ea3d85091b0fd0b01201ede87d`	affected	< aadf655e8ea9a8ffa24bb8d69f504572e8d18181

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[583be982d93479ea3d85091b0fd0b01201ede87d,af6e4f931afc2d670d133aa2bedc8b6e3753c618)`	affected	code_commit	—
`[583be982d93479ea3d85091b0fd0b01201ede87d,63120572edde85bb2b70b0ed4d4817ed52247613)`	affected	code_commit	—
`[583be982d93479ea3d85091b0fd0b01201ede87d,f37f42e6e039a48c2dcf6c079b9f7fbc864ab7ef)`	affected	code_commit	—
`[583be982d93479ea3d85091b0fd0b01201ede87d,aadf655e8ea9a8ffa24bb8d69f504572e8d18181)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	generic	—
`[0,5.15)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel update that includes the net/mctp commit that publishes the device only after it is fully initialized.
If an immediate kernel upgrade cannot be performed, rebuild the kernel with the net/mctp driver disabled (CONFIG_NET_MCTP=n) or unload the mctp module in a modular build.
After disabling the driver or applying the update, restart or reload the networking stack to ensure no residual mctp devices remain.

Generated by OpenCVE AI on October 24, 2026 at 04:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0018.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98812.mbox
https://git.kernel.org/stable/c/288ef37e0c463192dbb6436e61cdc07ce666dcb9
https://git.kernel.org/stable/c/58a270b5ecd8629114a4754d642bad6a33bef493
https://git.kernel.org/stable/c/63120572edde85bb2b70b0ed4d4817ed52247613
https://git.kernel.org/stable/c/aadf655e8ea9a8ffa24bb8d69f504572e8d18181
https://git.kernel.org/stable/c/af6e4f931afc2d670d133aa2bedc8b6e3753c618
https://git.kernel.org/stable/c/f37f42e6e039a48c2dcf6c079b9f7fbc864ab7ef
https://git.kernel.org/stable/c/fdf09d0fa2fb639950bede185d22689f68df140e
https://nvd.nist.gov/vuln/detail/CVE-2026-98812
https://www.cve.org/CVERecord?id=CVE-2026-98812

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/58a270b5ecd8629114a4754d642bad6a33bef493 https://git.kernel.org/stable/c/fdf09d0fa2fb639950bede185d22689f68df140e

Sat, 24 Oct 2026 03:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-367

Sat, 24 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98812.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98812 https://www.cve.org/CVERecord?id=CVE-2026-98812
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/288ef37e0c463192dbb6436e61cdc07ce666dcb9

Sun, 18 Oct 2026 20:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367 CWE-476

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctp_dev only after it is initialised mctp_add_dev() links the new mctp_dev into dev->mctp_ptr before mdev->dev is assigned, so a reader that picks the device up in that window dereferences a net_device pointer that is still NULL: KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7] Call Trace: <TASK> ? __pfx_mctp_sendmsg (./include/linux/sockptr.h:49) ? __pfx_mctp_dst_output (net/mctp/route.c:41) ? selinux_socket_sendmsg (security/selinux/hooks.c:5278) ____sys_sendmsg (net/socket.c:775 (discriminator 1) net/socket.c:790 (discriminator 1) net/socket.c:2684 (discriminator 1)) ? __pfx_____sys_sendmsg (net/socket.c:1131) ? __pfx_copy_msghdr_from_user (net/socket.c:2590) ? update_cfs_rq_load_avg (kernel/sched/fair.c:5478) ___sys_sendmsg (net/socket.c:2738) ? __pfx____sys_sendmsg (net/socket.c:2625) ? perf_event_task_tick (./include/linux/rcupdate.h:838) ? sched_tick (kernel/sched/core.c:5818) ? clockevents_program_event (kernel/time/clockevents.c:372) ? fdget (./include/linux/rcupdate.h:873 fs/file.c:1100) __sys_sendmsg (net/socket.c:2770) ? __pfx___sys_sendmsg (net/socket.c:2751) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK> Fix by publishing only once the object is fully initialised: __mctp_dev_get() runs under rcu_read_lock() only and hands this object to readers as soon as mctp_ptr is assigned, so they must never observe mdev->dev == NULL.
Title		net/mctp: publish the mctp_dev only after it is initialised
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/63120572edde85bb2b70b0ed4d4817ed52247613 https://git.kernel.org/stable/c/aadf655e8ea9a8ffa24bb8d69f504572e8d18181 https://git.kernel.org/stable/c/af6e4f931afc2d670d133aa2bedc8b6e3753c618 https://git.kernel.org/stable/c/f37f42e6e039a48c2dcf6c079b9f7fbc864ab7ef

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:48:58.470Z

Updated: 2026-10-30T12:39:58.094Z

Reserved: 2026-09-25T10:25:14.371Z

Link: CVE-2026-98812

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:35.313

Modified: 2026-10-30T13:21:28.907

Link: CVE-2026-98812

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98812 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T04:30:08Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object