CVE-2026-80995

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctp_route_lookup() mctp_route_lookup() uses rt->dev without holding a reference on it. mctp_route_lookup_single() returns the route under RCU only, so the route's device can be torn down concurrently: mctp_dev_put() drops the last reference and synchronously kfree()s mdev->addrs. mctp_dev_saddr() then reads rt->dev->addrs[0], giving a use-after-free reachable by an unprivileged local AF_MCTP user on the receive/forwarding path (no CAP_NET_RAW required): BUG: KASAN: slab-use-after-free in mctp_route_lookup Read of size 1 at addr ... by task mctp_uaf/... mctp_route_lookup mctp_pkttype_receive Freed by task ...: kfree mctp_dev_put mctp_dev_notify In the same window mctp_dst_from_route() -> mctp_dev_hold() also increments a refcount that has already reached zero ("refcount_t: addition on 0 ... mctp_dev_hold"). This reintroduces the use-after-free class of CVE-2023-3439: the source address lookup was moved ahead of the point where the destination takes its device reference. Take a reference with refcount_inc_not_zero() before touching rt->dev, skip a device that is already dead, and drop the reference once the destination has taken its own.

• https://git.kernel.org/stable/c/408da1df18116c971c3392e21e50586688cd3fbf
• https://git.kernel.org/stable/c/cc561f8af25586300c2f9d285babb163b866b293

Published

Sep 11, 2026

Last Modified

Sep 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-80989In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-80990In the Linux kernel, the following vulnerability has been re…
• CVE-2026-80991In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-80992In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-80993In the Linux kernel, the following vulnerability has been re…
• CVE-2026-80994In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-80996In the Linux kernel, the following vulnerability has been re…
• CVE-2026-80997In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-80998In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-80999In the Linux kernel, the following vulnerability has been re…
• CVE-2026-8100Impact A security issue has been identified in Chef 360 tha…8.6
• CVE-2026-81000In the Linux kernel, the following vulnerability has been re…7.8