CVE-2026-98812

In the Linux kernel, the following vulnerability has been resolved:

net/mctp: publish the mctp dev only after it is initialised

mctp add dev() links the new mctp dev into dev->mctp ptr before mdev->dev is assigned, so a reader that picks the device up in that window dereferences a net device pointer that is still NULL:

KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7] Call Trace: ? pfx mctp sendmsg (./include/linux/sockptr.h:49) ? pfx mctp dst output (net/mctp/route.c:41) ? selinux socket sendmsg (security/selinux/hooks.c:5278) sys sendmsg (net/socket.c:775 (discriminator 1) net/socket.c:790 (discriminator 1) net/socket.c:2684 (discriminator 1)) ? pfx sys sendmsg (net/socket.c:1131) ? pfx copy msghdr from user (net/socket.c:2590) ? update cfs rq load avg (kernel/sched/fair.c:5478) sys sendmsg (net/socket.c:2738) ? pfx sys sendmsg (net/socket.c:2625) ? perf event task tick (./include/linux/rcupdate.h:838) ? sched tick (kernel/sched/core.c:5818) ? clockevents program event (kernel/time/clockevents.c:372) ? fdget (./include/linux/rcupdate.h:873 fs/file.c:1100) sys sendmsg (net/socket.c:2770) ? pfx sys sendmsg (net/socket.c:2751) do syscall 64 (arch/x86/entry/syscall 64.c:63) entry SYSCALL 64 after hwframe (arch/x86/entry/entry 64.S:121)

Fix by publishing only once the object is fully initialised: mctp dev get() runs under rcu read lock() only and hands this object to readers as soon as mctp ptr is assigned, so they must never observe mdev->dev == NULL.