CVE-2026-68124

Summary (CVE-2026-68124): In the Linux kernel’s MCTP serial path (mctp_serial_tty_receive_buf), a zero-length frame could cause an out-of-bounds heap write when rxlen is 0 and the parser enters STATE_DATA, allowing attacker-controlled writes after CAP_NET_ADMIN attaches the mctpserial netdev. The...

EUVD-2026-55505

In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...