CVE-2026-85032

The MCTP over USB device class in subsys/pmci/mctp/mctpusb.c splits RX handling across two threads: the system workqueue runs mctpusbclassoutwork, which parses host OUT data byte by byte and fills a packet buffer at usb-rxpkt, while the USB device stack thread runs mctpusbclassdisable. The disabl...

CVE-2026-85032 Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress

The MCTP over USB device class in subsys/pmci/mctp/mctpusb.c splits RX handling across two threads: the system workqueue runs mctpusbclassoutwork, which parses host OUT data byte by byte and fills a packet buffer at usb-rxpkt, while the USB device stack thread runs mctpusbclassdisable. The disabl...

CVE-2026-85032 Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress

The MCTP over USB device class in subsys/pmci/mctp/mctpusb.c splits RX handling across two threads: the system workqueue runs mctpusbclassoutwork, which parses host OUT data byte by byte and fills a packet buffer at usb-rxpkt, while the USB device stack thread runs mctpusbclassdisable. The disabl...

CVE-2026-85032

The MCTP subsystem in Zephyr (built with CONFIG_MCTP_USB) is vulnerable to a use-after-free condition in the mctp_usb.c binding. The issue occurs when mctp_usb_class_disable() is triggered by a USB host (via SET_CONFIGURATION or bus reset) while the system workqueue is still parsing host OUT data...

EUVD-2026-115820

The MCTP over USB device class in subsys/pmci/mctp/mctpusb.c splits RX handling across two threads: the system workqueue runs mctpusbclassoutwork, which parses host OUT data byte by byte and fills a packet buffer at usb-rxpkt, while the USB device stack thread runs mctpusbclassdisable. The disabl...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it only against the upper bound: if c...

SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:4935-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4935-1 advisory. The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues: The following security issues were fixed: CVE-2025-68358: btrfs: fix racy bitfield write in btrfsclearspaceinfofull bsc1255531. CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit bsc1264267...

SUSE-SU-2026:4940-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68358: btrfs: fix racy bitfield write in btrfsclearspaceinfofull bsc1255531. - CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit bsc1264267...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2025-68358: btrfs: fix racy bitfield write in btrfsclearspaceinfofull bsc1255531. CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit bsc1264267...

SUSE-SU-2026:4935-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68358: btrfs: fix racy bitfield write in btrfsclearspaceinfofull bsc1255531. - CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit bsc1264267. -...

SUSE-SU-2026:24473-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68358: btrfs: fix racy bitfield write in btrfsclearspaceinfofull bsc1255531. - CVE-2026-43091: xfrm: Wait for RCU readers during policy netn...

CVE-2026-98812

A flaw was found in the Linux kernel's Management Component Transport Protocol MCTP subsystem. This vulnerability allows a local user to cause a Denial of Service DoS by triggering a kernel crash. During device setup, the kernel exposes the network device object before its internal pointers are...

SUSE CVE-2026-98525

In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctplookupprealloctag When a socket transmits a packet with MCTPTAGPREALLOC set, mctplookupprealloctag iterates over the per-netns &mns-keys list and matches netid, reqtag, peeraddr, and...

CVE-2026-79976

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctpi2cgpiotarget.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register b-regaddr and the data-phase flag b-rxtx were never cleared wh...

CVE-2026-79976

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c is vulnerable to a NULL pointer dereference because the b->reg_addr and b->rxtx flags are not cleared when an I2C STOP is issued. This allows a controller on the shared management bus to re-enter mctp_i2c_gpio_...

CVE-2026-79976 NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctpi2cgpiotarget.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register b-regaddr and the data-phase flag b-rxtx were never cleared wh...

CVE-2026-79976 NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctpi2cgpiotarget.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register b-regaddr and the data-phase flag b-rxtx were never cleared wh...

EUVD-2026-107487

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctpi2cgpiotarget.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register b-regaddr and the data-phase flag b-rxtx were never cleared wh...

CVE-2026-79976 NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctpi2cgpiotarget.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register b-regaddr and the data-phase flag b-rxtx were never cleared wh...