CVE-2026-80995: net: mctp: hold a reference to the route device in mctp_route_lookup()

CVE-2026-80995: net: mctp: hold a reference to the route device in mctp_route_lookup()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: hold a reference to the route device in mctp_route_lookup()

mctp_route_lookup() uses rt->dev without holding a reference on it.
mctp_route_lookup_single() returns the route under RCU only, so the
route's device can be torn down concurrently: mctp_dev_put() drops the
last reference and synchronously kfree()s mdev->addrs.  mctp_dev_saddr()
then reads rt->dev->addrs[0], giving a use-after-free reachable by an
unprivileged local AF_MCTP user on the receive/forwarding path (no
CAP_NET_RAW required):

  BUG: KASAN: slab-use-after-free in mctp_route_lookup
  Read of size 1 at addr ... by task mctp_uaf/...
   mctp_route_lookup
   mctp_pkttype_receive
  Freed by task ...:
   kfree
   mctp_dev_put
   mctp_dev_notify

In the same window mctp_dst_from_route() -> mctp_dev_hold() also
increments a refcount that has already reached zero
("refcount_t: addition on 0 ... mctp_dev_hold").

This reintroduces the use-after-free class of CVE-2023-3439: the source
address lookup was moved ahead of the point where the destination takes
its device reference.

Take a reference with refcount_inc_not_zero() before touching rt->dev,
skip a device that is already dead, and drop the reference once the
destination has taken its own.

The Linux kernel CVE team has assigned CVE-2026-80995 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 7.1 with commit 22cb45afd221b9e4f2a1dcc74a8ff645b7293aa1 and fixed in 7.2.4 with commit cc561f8af25586300c2f9d285babb163b866b293
	Issue introduced in 7.1 with commit 22cb45afd221b9e4f2a1dcc74a8ff645b7293aa1 and fixed in 7.3-rc1 with commit 408da1df18116c971c3392e21e50586688cd3fbf

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-80995
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/mctp/route.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/cc561f8af25586300c2f9d285babb163b866b293
	https://git.kernel.org/stable/c/408da1df18116c971c3392e21e50586688cd3fbf