UBUNTU-CVE-2026-43455: Low severity ubuntu/linux-hwe-edge vulnerability

Published May 8, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: mctp: route: hold key->lock in mctpflowprepareoutput() mctpflowprepareoutput() checks key->dev and may call mctpdevsetkey(), but it does not hold key->lock while doing so. mctpdevsetkey() and mctpdevreleasekey() are annotated with musthold(&key->lock), so key->dev access is intended to be serialized by key->lock. The mctpsendmsg() transmit path reaches mctpflowprepareoutput() via mctplocaloutput() -> mctpdstoutput() without holding key->lock, so the check-and-set sequence is racy. Example interleaving: CPU0 CPU1 ---- ---- mctpflowprepareoutput(key, devA) if (!key->dev) // sees NULL mctpflowprepareoutput( key, devB) if (!key->dev) // still NULL mctpdevsetkey(devB, key) mctpdevhold(devB) key->dev = devB mctpdevsetkey(devA, key) mctpdevhold(devA) key->dev = devA // overwrites devB Now both devA and devB references were acquired, but only the final key->dev value is tracked for release. One reference can be lost, causing a resource leak as mctpdevreleasekey() would only decrease the reference on one dev. Fix by taking key->lock around the key->dev check and mctpdevsetkey() call.

Affected Software

148 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1061.64~22.04.1

6.8.0-1061.64~22.04.1

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1063.71~22.04.1

6.8.0-1063.71~22.04.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1062.69~22.04.1

6.8.0-1062.69~22.04.1

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1064.72~22.04.1

6.8.0-1064.72~22.04.1

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-136.136~22.04.1

6.8.0-136.136~22.04.1

ubuntu/linux-ibm-6.8<6.8.0-1061.62~22.04.1

6.8.0-1061.62~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-136.136.2~22.04.1

6.8.0-136.136.2~22.04.1

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1059.62~22.04.1

6.8.0-1059.62~22.04.1

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1058.61~22.04.1

6.8.0-1058.61~22.04.1

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-136.136~22.04.3

6.8.0-136.136~22.04.3

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime-6.8<6.8.1-1056.57~22.04.2

6.8.1-1056.57~22.04.2

ubuntu/linux<6.8.0-136.136

6.8.0-136.136

ubuntu/linux-aws<6.8.0-1061.64

6.8.0-1061.64

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-azure<6.8.0-1063.71

6.8.0-1063.71

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-fde<6.8.0-1062.69

6.8.0-1062.69

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1064.72

6.8.0-1064.72

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gke<6.8.0-1059.67

6.8.0-1059.67

ubuntu/linux-gkeop<6.8.0-1046.50

6.8.0-1046.50

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-ibm<6.8.0-1061.62

6.8.0-1061.62

ubuntu/linux-lowlatency<6.8.0-136.136.2

6.8.0-136.136.2

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1059.62

6.8.0-1059.62

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-lowlatency<6.8.0-1059.62.1

6.8.0-1059.62.1

ubuntu/linux-nvidia-tegra<6.8.0-1030.31

6.8.0-1030.31

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1058.61

6.8.0-1058.61

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-raspi<6.8.0-1061.65

6.8.0-1061.65

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-xilinx<6.8.0-1033.34

6.8.0-1033.34

ubuntu/linux-bluefield<6.8.0-1028.33

6.8.0-1028.33

ubuntu/linux-raspi-realtime<6.8.0-2050.52

6.8.0-2050.52

ubuntu/linux-realtime<6.8.1-1056.57

6.8.1-1056.57

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips<6.8.0-1061.64+fips1

6.8.0-1061.64+fips1

ubuntu/linux-azure-fips<6.8.0-1063.71+fips2

6.8.0-1063.71+fips2

ubuntu/linux-fips<6.8.0-136.136+fips2

6.8.0-136.136+fips2

ubuntu/linux-gcp-fips<6.8.0-1064.72+fips1

6.8.0-1064.72+fips1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp*

ubuntu/linux-oracle*

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.64~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.71~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.69~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.72~22.04.1
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.62~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136.2~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.62~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.61~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136~22.04.3
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1056.57~22.04.2
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.64
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.71
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.69
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.72
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.67
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.50
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.62
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136.2
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.62
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.62.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1030.31
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.61
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.65
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1033.34
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.33
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2050.52
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1056.57
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.64+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.71+fips2
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136+fips2
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.72+fips1
Compensating control
In mctp_flow_prepare_output(), acquire key->lock around the key->dev check and the mctp_dev_set_key() call so the check-and-set sequence is serialized.

Event History

May 8, 2026

CVE Published

via OSV·03:16 PM

Data Sourced

via OSV·03:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What level of access is required to trigger this issue?

The vector indicates local access, low attack complexity, high privileges, and no user interaction. The described race occurs on the MCTP send path when concurrent operations prepare output using the same key.

What is the practical impact if the race is triggered?

Concurrent output preparation can associate the same key with two devices while tracking only the final device reference. This can leave one device reference unreleased, causing a resource leak; the reported impact is limited to availability.

Which Ubuntu kernel package families are listed as affected?

The listed package families are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-hwe-edge, ubuntu/linux-gke, and ubuntu/linux-gkeop.

UBUNTU-CVE-2026-43455: Low severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access is required to trigger this issue?

What is the practical impact if the race is triggered?

Which Ubuntu kernel package families are listed as affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access is required to trigger this issue?

What is the practical impact if the race is triggered?

Which Ubuntu kernel package families are listed as affected?