CVE-2026-85032

The MCTP over USB device class in subsys/pmci/mctp/mctpusb.c splits RX handling across two threads: the system workqueue runs mctpusbclassoutwork, which parses host OUT data byte by byte and fills a packet buffer at usb-rxpkt, while the USB device stack thread runs mctpusbclassdisable. The disabl...

CVE-2026-85032 Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress

The MCTP over USB device class in subsys/pmci/mctp/mctpusb.c splits RX handling across two threads: the system workqueue runs mctpusbclassoutwork, which parses host OUT data byte by byte and fills a packet buffer at usb-rxpkt, while the USB device stack thread runs mctpusbclassdisable. The disabl...

CVE-2026-85032

The MCTP subsystem in Zephyr (built with CONFIG_MCTP_USB) is vulnerable to a use-after-free condition in the mctp_usb.c binding. The issue occurs when mctp_usb_class_disable() is triggered by a USB host (via SET_CONFIGURATION or bus reset) while the system workqueue is still parsing host OUT data...

EUVD-2026-115820

The MCTP over USB device class in subsys/pmci/mctp/mctpusb.c splits RX handling across two threads: the system workqueue runs mctpusbclassoutwork, which parses host OUT data byte by byte and fills a packet buffer at usb-rxpkt, while the USB device stack thread runs mctpusbclassdisable. The disabl...

CVE-2025-21972

In the Linux kernel, the following vulnerability has been resolved: net: mctp: unshare packets when reassembling Ensure that the fraglist used for reassembly isn't shared with other packets. This avoids incorrect reassembly when packets are cloned, and prevents a memory leak due to circular...