CVE-2026-98525: mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
In the Linux kernel, the following vulnerability has been resolved:
mctp: route: iterate socket tag list in mctplookupprealloctag()
When a socket transmits a packet with MCTPTAGPREALLOC set, mctplookupprealloctag() iterates over the per-netns &mns->keys list and matches netid, reqtag, peeraddr, and manualalloc, without checking whether tmp->sk == &msk->sk. This allows any MCTP socket in the same network namespace to use and consume another socket's preallocated tag.
Iterate the socket's own tag list (&msk->keys via sklist) instead of the namespace-wide &mns->keys list in mctplookupprealloctag(), ensuring that only tags allocated by msk are matched.
Tested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag (0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a 4-byte message with MCTPTAGPREALLOC from socket B in the same network namespace. On the unfixed kernel, sendto(sockb) using socket A's preallocated tag succeeds (ret = 4); with this patch applied, sendto(sockb) fails with -ENOENT (errno = 2) while sendto(socka) succeeds (ret = 4).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems and processes are exposed to this issue?
The issue affects MCTP sockets that share a network namespace. Any MCTP socket in that namespace can match and consume a tag preallocated by a different MCTP socket on an unfixed kernel.
What does an attacker need in order to exploit it?
An attacker needs the ability to use an MCTP socket in the same network namespace as the socket that owns a preallocated tag. They can send using MCTP_TAG_PREALLOC with matching network ID, request tag, and peer address to use the other socket's tag.
How can I verify whether the fix is present?
Allocate a manual tag on one MCTP socket for a peer, then attempt to send with MCTP_TAG_PREALLOC from a second socket in the same network namespace using that tag. On the unfixed behavior, the second send succeeds; with the fix, it fails with -ENOENT while sending from the owning socket succeeds.