CVE-2026-98812Medium· 5.5▾ SunlitA flaw was found in the Linux kernel's Management Component Transport Protocol (MCTP) subsystem. This vulnerability allows a local user to cause a Denial of Service (DoS) by triggering a kernel crash. During device setup, the kernel expose…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
— → 5.5
none → medium
A flaw was found in the Linux kernel's Management Component Transport Protocol (MCTP) subsystem. This vulnerability allows a local user to cause a Denial of Service (DoS) by triggering a kernel crash. During device setup, the kernel exposes the network device object before its internal pointers are fully initialized. A concurrent operation accessing the uninitialized device dereferences a null pointer, crashing the system.
kernel: net/mctp: publish the mctp_dev only after it is initialised — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.
Not affected:
Refer to the advisory for fix availability.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-98875Medium· 4.4kernel: drm/nouveau/gsp: add SEC2 to GA100 chip table (CVE-2026-98875)
CVE-2026-98870Medium· 6.5kernel: ksmbd: remove stale channels from all sessions on teardown (CVE-2026-98870)
CVE-2026-98876Medium· 4.1kernel: host1x: bus: Fix missing ops null check in error teardown (CVE-2026-98876)
CVE-2026-98877Medium· 4.7kernel: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed (CVE-2026-98877)
CVE-2026-105923Medium· 5.5qt6: qt6: Denial of Service via crafted SVG in VectorImage (CVE-2026-105923)
CVE-2026-114046Medium· 6.5freerdp: FreeRDP: null pointer dereference in smartcard emulation via crafted reader name (CVE-2026-114046)