CVE-2026-79976

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctpi2cgpiotarget.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register b-regaddr and the data-phase flag b-rxtx were never cleared wh...

EUVD-2026-107487

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctpi2cgpiotarget.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register b-regaddr and the data-phase flag b-rxtx were never cleared wh...

PT-2026-120779

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp i2c gpio target.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register b-reg addr and the data-phase flag b-rxtx were never cleare...

Zephyr improper exception handling vulnerability

Versions Zephyr 4.3.0 through 4.4.2 contain an improper exception handling vulnerability. This vulnerability arises because the MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctpi2cgpiotarget.c fails to clear selected registers and data phase flags when I2C is in STOP mode. As a result,...

CVE-2026-10678: NULL Pointer Dereference

The MCTP-over-I2C+GPIO target binding in Zephyr subsys/pmci/mctp/mctpi2cgpiotarget.c processes pseudo-register writes from an I2C bus master byte-by-byte in mctpi2cgpiotargetwritereceived without validating the order or the receive buffer. In the affected versions the MCTPI2CGPIORXMSGADDR data...