CVE-2026-98525: mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()

Published Oct 18, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

mctp: route: iterate socket tag list in mctplookupprealloctag()

When a socket transmits a packet with MCTPTAGPREALLOC set, mctplookupprealloctag() iterates over the per-netns &mns->keys list and matches netid, reqtag, peeraddr, and manualalloc, without checking whether tmp->sk == &msk->sk. This allows any MCTP socket in the same network namespace to use and consume another socket's preallocated tag.

Iterate the socket's own tag list (&msk->keys via sklist) instead of the namespace-wide &mns->keys list in mctplookupprealloctag(), ensuring that only tags allocated by msk are matched.

Tested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag (0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a 4-byte message with MCTPTAGPREALLOC from socket B in the same network namespace. On the unfixed kernel, sendto(sockb) using socket A's preallocated tag succeeds (ret = 4); with this patch applied, sendto(sockb) fails with -ENOENT (errno = 2) while sendto(socka) succeeds (ret = 4).

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 18, 2026

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

Description

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

Which systems and processes are exposed to this issue?

The issue affects MCTP sockets that share a network namespace. Any MCTP socket in that namespace can match and consume a tag preallocated by a different MCTP socket on an unfixed kernel.

What does an attacker need in order to exploit it?

An attacker needs the ability to use an MCTP socket in the same network namespace as the socket that owns a preallocated tag. They can send using MCTP_TAG_PREALLOC with matching network ID, request tag, and peer address to use the other socket's tag.

How can I verify whether the fix is present?

Allocate a manual tag on one MCTP socket for a peer, then attempt to send with MCTP_TAG_PREALLOC from a second socket in the same network namespace using that tag. On the unfixed behavior, the second send succeeds; with the fix, it fails with -ENOENT while sending from the owning socket succeeds.

CVE-2026-98525: mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()

Affected Software

Event History

Frequently Asked Questions

Which systems and processes are exposed to this issue?

What does an attacker need in order to exploit it?

How can I verify whether the fix is present?

Company

Resources

Contact

Frequently Asked Questions

Which systems and processes are exposed to this issue?

What does an attacker need in order to exploit it?

How can I verify whether the fix is present?