CVE-2026-98812: net/mctp: publish the mctp_dev only after it is initialised

In the Linux kernel, the following vulnerability has been resolved:

net/mctp: publish the mctpdev only after it is initialised

mctpadddev() links the new mctpdev into dev->mctpptr before mdev->dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that is still NULL:

KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7] Call Trace: <TASK> ? pfxmctpsendmsg (./include/linux/sockptr.h:49) ? pfxmctpdstoutput (net/mctp/route.c:41) ? selinuxsocketsendmsg (security/selinux/hooks.c:5278) syssendmsg (net/socket.c:775 (discriminator 1) net/socket.c:790 (discriminator 1) net/socket.c:2684 (discriminator 1)) ? pfxsyssendmsg (net/socket.c:1131) ? pfxcopymsghdrfromuser (net/socket.c:2590) ? updatecfsrqloadavg (kernel/sched/fair.c:5478) syssendmsg (net/socket.c:2738) ? pfxsyssendmsg (net/socket.c:2625) ? perfeventtasktick (./include/linux/rcupdate.h:838) ? schedtick (kernel/sched/core.c:5818) ? clockeventsprogramevent (kernel/time/clockevents.c:372) ? fdget (./include/linux/rcupdate.h:873 fs/file.c:1100) syssendmsg (net/socket.c:2770) ? pfxsyssendmsg (net/socket.c:2751) dosyscall64 (arch/x86/entry/syscall64.c:63) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121) </TASK>

Fix by publishing only once the object is fully initialised: mctpdevget() runs under rcureadlock() only and hands this object to readers as soon as mctpptr is assigned, so they must never observe mdev->dev == NULL.