315 matches found
SUSE CVE-2026-68314
In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctpi3cmodinit registers the I3C bus notifier and then walks the existing buses with i3cforeachbuslockedmctpi3cbusaddnew, NULL before registering the I3C device...
CVE-2026-68124
A flaw was found in the Linux kernel's Message Control Transport Protocol MCTP serial driver. The driver's receive state machine incorrectly handles zero-length frames, leading to an out-of-bounds write. A local attacker with CAPNETADMIN capabilities can exploit this vulnerability by sending...
CVE-2026-68314
A flaw was found in the Linux kernel's MCTP I3C network module. When the i3cdriverregister function fails during module initialization, the system does not properly unregister notifiers and deallocate bus objects. This oversight leads to a memory leak, which could be exploited by a local attacker...
mctp: serial: handle zero-length frames to prevent rx buffer overflow
...
CVE-2026-68314
In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctpi3cmodinit registers the I3C bus notifier and then walks the existing buses with i3cforeachbuslockedmctpi3cbusaddnew, NULL before registering the I3C device...
CVE-2026-68314
In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctpi3cmodinit registers the I3C bus notifier and then walks the existing buses with i3cforeachbuslockedmctpi3cbusaddnew, NULL before registering the I3C device...
UBUNTU-CVE-2026-68314
In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctpi3cmodinit registers the I3C bus notifier and then walks the existing buses with i3cforeachbuslockedmctpi3cbusaddnew, NULL before registering the I3C device...
CVE-2026-68124
In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...
UBUNTU-CVE-2026-68124
In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...
CVE-2026-68124
In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...
CVE-2026-68314 net: mctp i3c: clean up notifier and buses if driver register fails
In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctpi3cmodinit registers the I3C bus notifier and then walks the existing buses with i3cforeachbuslockedmctpi3cbusaddnew, NULL before registering the I3C device...
CVE-2026-68314 net: mctp i3c: clean up notifier and buses if driver register fails
In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctpi3cmodinit registers the I3C bus notifier and then walks the existing buses with i3cforeachbuslockedmctpi3cbusaddnew, NULL before registering the I3C device...
CVE-2026-68124 mctp: serial: handle zero-length frames to prevent rx buffer overflow
In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...
CVE-2026-68124
CVE-2026-68124 affects the Linux kernel MCTP serial driver. A zero-length frame could cause an out-of-bounds write in the receive path when rxlen == 0, requiring CAP_NET_ADMIN to attach the MCTP line discipline and bring up the netdev. The fix routes zero-length frames to STATE_TRAILER (instead o...
CVE-2026-68124 mctp: serial: handle zero-length frames to prevent rx buffer overflow
In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...
EUVD-2026-55505
In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...
PT-2026-69524
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds heap write exists in the MCTP serial receive state machine. The issue occurs in the mctp serial push header function when a frame length byte of zero is processed. Becau...
CVE-2026-68124: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...
CVE-2026-68314: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctpi3cmodinit registers the I3C bus notifier and then walks the existing buses with i3cforeachbuslockedmctpi3cbusaddnew, NULL before registering the I3C device...
PT-2026-69714
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mctp i3c mod init function where the I3C bus notifier is registered and existing buses are processed using i3c for each bus lockedmctp i3c bus add new, NULL before...