{"id":"CVE-2026-98525","revision":"4d0468df4b924a4eba97cc29798180a8","records":[{"revision":"4d0468df4b924a4eba97cc29798180a8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98525","aliases":[],"title":"mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()\n\nWhen a socket transmits a packet with MCTP_TAG_PREALLOC set,\nmctp_lookup_prealloc_tag() iterates over the per-netns &mns->keys list\nand matches netid, req_tag, peer_addr, and manual_alloc, without\nchecking whether tmp->sk == &msk->sk. This allows any MCTP socket in the\nsame network namespace to use and consume another socket's preallocated\ntag.\n\nIterate the socket's own tag list (&msk->keys via sklist) instead of the\nnamespace-wide &mns->keys list in mctp_lookup_prealloc_tag(), ensuring\nthat only tags allocated by msk are matched.\n\nTested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag\n(0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a\n4-byte message with MCTP_TAG_PREALLOC from socket B in the same network\nnamespace. On the unfixed kernel, sendto(sock_b) using socket A's\npreallocated tag succeeds (ret = 4); with this patch applied,\nsendto(sock_b) fails with -ENOENT (errno = 2) while sendto(sock_a)\nsucceeds (ret = 4).","state":0,"publishedAt":"2026-10-18T15:17:43.216+00:00","modifiedAt":"2026-10-19T09:21:07.01+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/mctp/route.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"63ed1aab3d40aa61aaa66819bdce9377ac7f40fa\",\n                            \"lessThan\": \"09299addab11857e92eca55cd8ef3350b927c90c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"63ed1aab3d40aa61aaa66819bdce9377ac7f40fa\",\n                            \"lessThan\": \"e35cb500dd14882f8dee61783fccd1823fd3ab0d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"63ed1aab3d40aa61aaa66819bdce9377ac7f40fa\",\n                            \"lessThan\": \"f178300e2f56ca9ec2a3a0090608730bbee0af7b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"63ed1aab3d40aa61aaa66819bdce9377ac7f40fa\",\n                            \"lessThan\": \"26cc0e69cce062cd3aa6fae33074684669c35a71\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/mctp/route.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/09299addab11857e92eca55cd8ef3350b927c90c","https://git.kernel.org/stable/c/e35cb500dd14882f8dee61783fccd1823fd3ab0d","https://git.kernel.org/stable/c/f178300e2f56ca9ec2a3a0090608730bbee0af7b","https://git.kernel.org/stable/c/26cc0e69cce062cd3aa6fae33074684669c35a71"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98525","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98525","identifiers":["CVE-2026-98525"]},"retained":false,"historicalAffected":[]}],"coverage":[]}