UBUNTU-CVE-2026-98525: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctplookupprealloctag() When a socket transmits a packet with MCTPTAGPREALLOC set, mctplookupprealloctag() iterates over the per-netns &mns->keys list and matches netid, reqtag, peeraddr, and manualalloc, without checking whether tmp->sk == &msk->sk. This allows any MCTP socket in the same network namespace to use and consume another socket's preallocated tag. Iterate the socket's own tag list (&msk->keys via sklist) instead of the namespace-wide &mns->keys list in mctplookupprealloctag(), ensuring that only tags allocated by msk are matched. Tested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag (0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a 4-byte message with MCTPTAGPREALLOC from socket B in the same network namespace. On the unfixed kernel, sendto(sockb) using socket A's preallocated tag succeeds (ret = 4); with this patch applied, sendto(sockb) fails with -ENOENT (errno = 2) while sendto(socka) succeeds (ret = 4).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to create or control an MCTP socket in the same network namespace as a victim MCTP socket. They also need knowledge of a tag preallocated by the other socket, including the matching network ID, requested tag, and peer address.
What is the impact of successful exploitation?
A malicious or unintended MCTP socket can send using and consume a preallocated tag belonging to another socket in the same network namespace. This can interfere with the owning socket's use of its manually allocated MCTP tags.
How can I determine whether a system is affected?
The issue is present if a socket other than the one that allocated a manual MCTP tag can successfully send a packet with MCTP_TAG_PREALLOC using that tag in the same network namespace. On a fixed kernel, that send fails with ENOENT, while the allocating socket can still send successfully.
What is the mitigation if an update cannot be applied immediately?
Restrict access to MCTP sockets within shared network namespaces, and avoid placing mutually untrusted workloads that can use MCTP in the same network namespace. Separate such workloads into different network namespaces to prevent cross-socket tag use.