CVE-2026-80995

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: hold a reference to the route device in mctp route lookup()

mctp route lookup() uses rt->dev without holding a reference on it. mctp route lookup single() returns the route under RCU only, so the route's device can be torn down concurrently: mctp dev put() drops the last reference and synchronously kfree()s mdev->addrs. mctp dev saddr() then reads rt->dev->addrs[0], giving a use-after-free reachable by an unprivileged local AF MCTP user on the receive/forwarding path (no CAP NET RAW required):

BUG: KASAN: slab-use-after-free in mctp route lookup Read of size 1 at addr ... by task mctp uaf/... mctp route lookup mctp pkttype receive Freed by task ...: kfree mctp dev put mctp dev notify

In the same window mctp dst from route() -> mctp dev hold() also increments a refcount that has already reached zero ("refcount t: addition on 0 ... mctp dev hold").

This reintroduces the use-after-free class of CVE-2023-3439: the source address lookup was moved ahead of the point where the destination takes its device reference.

Take a reference with refcount inc not zero() before touching rt->dev, skip a device that is already dead, and drop the reference once the destination has taken its own.