CVE-2026-85032 Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress

The MCTP over USB device class in subsys/pmci/mctp/mctpusb.c splits RX handling across two threads: the system workqueue runs mctpusbclassoutwork, which parses host OUT data byte by byte and fills a packet buffer at usb-rxpkt, while the USB device stack thread runs mctpusbclassdisable. The disabl...