Race Condition in Linux Kernel Affecting MCTP Functionality

CVE-2026-43455

What is CVE-2026-43455?

A race condition vulnerability exists in the Linux kernel's MCTP implementation. The issue arises from inadequate serialization of access to the 'key->dev' variable, leading to potential resource leaks. Specifically, the function mctp_flow_prepare_output() fails to hold the appropriate lock when checking for 'key->dev'. This allows concurrent threads to modify 'key->dev' without proper synchronization, resulting in inconsistencies and incorrect handling of device references. The flaw can potentially lead to lost references, making it crucial for users to apply the relevant patches to ensure system stability and security.

References