PT-2026-39116 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-21 · CVE-2026-43455

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the mctp flow prepare output() function. The function checks key->dev and may call mctp dev set key() without holding the key->lock, despite the latter being intended for serialization. This occurs during the mctp sendmsg() transmit path via mctp local output() and mctp dst output(). If two CPUs execute this sequence simultaneously, one device reference can be overwritten, leading to a resource leak because mctp dev release key() will only decrease the reference count for one device.

Recommendations Apply the fix that ensures key->lock is held during the key->dev check and the mctp dev set key() call.

Fix

Related Identifiers

CVE-2026-43455

Affected Products

Linux Kernel

References · 17

• https://git.kernel.org/stable/c/86f5334fcb48a5b611c33364ab52ca684d0f6d91 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43455 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43455 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-43455 · Vendor Advisory
• https://git.kernel.org/stable/c/0695712f3a6f1a48915f95767cfb42077683dcdc · Patch
• https://git.kernel.org/stable/c/7d86aa41c073c4e7eb75fd2e674f1fd8f289728a · Patch
• https://git.kernel.org/stable/c/47893166bc5611ee9a20de6b8d2933b2320fb772 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43455 · Security Note
• https://git.kernel.org/stable/c/8d27d9b260dd19c1b519e1a13de6448f9984e30e · Patch
• https://ubuntu.com/security/CVE-2026-43455 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43455 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43455 · Vendor Advisory
• https://git.kernel.org/stable/c/925a5ffd99cddd7a7e41d5ad120c7a2c6d50260f · Patch
• https://twitter.com/hetmehtaa/status/2055151398283837677 · Twitter Post
• https://docs.bell-sw.com/security/cves/CVE-2026-43455 · Note