In the Linux kernel, the following vulnerability has been resolved: mctp: route: hold key-lock in mctp_flow_prepare_output() checks key-dev and may call mctp_dev_set_key(), but it does not hold key-lock while doing so. mctp_dev_set_key() and mctp_dev_release_key() are annotated with __must_hold(&key-lock), so key-dev access is intended to be serialized by key-lock. The mctp_sendmsg() transmit path reaches mctp_flow_prepare_output() via mctp_local_output() - mctp_dst_output() without holding key-lock, so the check-and-set sequence is racy. Example interleaving: CPU0 CPU1 ---- mctp_flow_prepare_output(key, devA) if (!key-dev) // sees NULL mctp_flow_prepare_output( key, devB) if (!key-dev) // still NULL mctp_dev_set_key(devB, key) mctp_dev_hold(devB) key-dev = devB mctp_dev_set_key(devA, key) mctp_dev_hold(devA) key-dev = devA // overwrites devB Now both devA and devB references were acquired, but only the final key-dev value is tracked for release.

One reference can be lost, causing a resource leak as mctp_dev_release_key() would only decrease the reference on one dev. Fix by taking key-lock around the key-dev check and mctp_dev_set_key() call.