CVE-2026-98812: net/mctp: publish the mctp_dev only after it is initialised
In the Linux kernel, the following vulnerability has been resolved:
net/mctp: publish the mctpdev only after it is initialised
mctpadddev() links the new mctpdev into dev->mctpptr before mdev->dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that is still NULL:
KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7] Call Trace: <TASK> ? pfxmctpsendmsg (./include/linux/sockptr.h:49) ? pfxmctpdstoutput (net/mctp/route.c:41) ? selinuxsocketsendmsg (security/selinux/hooks.c:5278) syssendmsg (net/socket.c:775 (discriminator 1) net/socket.c:790 (discriminator 1) net/socket.c:2684 (discriminator 1)) ? pfxsyssendmsg (net/socket.c:1131) ? pfxcopymsghdrfromuser (net/socket.c:2590) ? updatecfsrqloadavg (kernel/sched/fair.c:5478) syssendmsg (net/socket.c:2738) ? pfxsyssendmsg (net/socket.c:2625) ? perfeventtasktick (./include/linux/rcupdate.h:838) ? schedtick (kernel/sched/core.c:5818) ? clockeventsprogramevent (kernel/time/clockevents.c:372) ? fdget (./include/linux/rcupdate.h:873 fs/file.c:1100) syssendmsg (net/socket.c:2770) ? pfxsyssendmsg (net/socket.c:2751) dosyscall64 (arch/x86/entry/syscall64.c:63) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121) </TASK>
Fix by publishing only once the object is fully initialised: mctpdevget() runs under rcureadlock() only and hands this object to readers as soon as mctpptr is assigned, so they must never observe mdev->dev == NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In net/mctp, publish or link the mctp_dev object only after it is fully initialized, including assigning mdev->dev, so readers cannot observe mdev->dev as NULL.
Event History
Frequently Asked Questions
What conditions are required to trigger the fault?
The race requires a reader to obtain the newly added MCTP device after it is linked through dev->mctp_ptr but before its mdev->dev net_device pointer has been assigned. A concurrent MCTP send operation can then dereference the still-NULL pointer.
What is the observed impact?
The reported outcome is a NULL-pointer dereference detected by KASAN during the MCTP send path, with the trace reaching mctp_sendmsg and mctp_dst_output. This can cause a kernel fault.
What change resolves the issue?
The fix delays publication of the mctp_dev until after it has been initialized, preventing readers from observing it with an unset net_device pointer.