{"id":41284,"date":"2026-10-19T00:33:00","date_gmt":"2026-10-18T16:33:00","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98812"},"modified":"2026-10-19T00:33:00","modified_gmt":"2026-10-18T16:33:00","slug":"cve-2026-98812","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98812","title":{"rendered":"CVE-2026-98812 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet\/mctp: publish the"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/mctp: publish the mctp_dev only after it is initialised<\/p>\n<p>mctp_add_dev() links the new mctp_dev into dev-&gt;mctp_ptr before mdev-&gt;dev<br \/>\nis assigned, so a reader that picks the device up in that window<br \/>\ndereferences a net_device pointer that is still NULL:<\/p>\n<p>KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7]<br \/>\nCall Trace:<\/p>\n<p> ? __pfx_mctp_sendmsg (.\/include\/linux\/sockptr.h:49)<br \/>\n ? __pfx_mctp_dst_output (net\/mctp\/route.c:41)<br \/>\n ? selinux_socket_sendmsg (security\/selinux\/hooks.c:5278)<br \/>\n ____sys_sendmsg (net\/socket.c:775 (discriminator 1) net\/socket.c:790<br \/>\n (discriminator 1) net\/socket.c:2684 (discriminator 1))<br \/>\n ? __pfx_____sys_sendmsg (net\/socket.c:1131)<br \/>\n ? __pfx_copy_msghdr_from_user (net\/socket.c:2590)<br \/>\n ? update_cfs_rq_load_avg (kernel\/sched\/fair.c:5478)<br \/>\n ___sys_sendmsg (net\/socket.c:2738)<br \/>\n ? __pfx____sys_sendmsg (net\/socket.c:2625)<br \/>\n ? perf_event_task_tick (.\/include\/linux\/rcupdate.h:838)<br \/>\n ? sched_tick (kernel\/sched\/core.c:5818)<br \/>\n ? clockevents_program_event (kernel\/time\/clockevents.c:372)<br \/>\n ? fdget (.\/include\/linux\/rcupdate.h:873 fs\/file.c:1100)<br \/>\n __sys_sendmsg (net\/socket.c:2770)<br \/>\n ? __pfx___sys_sendmsg (net\/socket.c:2751)<br \/>\n do_syscall_64 (arch\/x86\/entry\/syscall_64.c:63)<br \/>\n entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)<\/p>\n<p>Fix by publishing only once the object is fully initialised:<br \/>\n__mctp_dev_get() runs under rcu_read_lock() only and hands<br \/>\nthis object to readers as soon as mctp_ptr is assigned, so<br \/>\nthey must never observe mdev-&gt;dev == NULL.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/mctp: publish the mctp_dev only after it is initialised<\/p>\n<p>mctp_add_dev() links the new mctp_dev into dev-&gt;mctp_ptr before mdev-&gt;<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41284","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41284","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41284"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41284"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41284"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}