CVE-2026-85032

The MCTP subsystem in Zephyr (built with CONFIG_MCTP_USB) is vulnerable to a use-after-free condition in the mctp_usb.c binding. The issue occurs when mctp_usb_class_disable() is triggered by a USB host (via SET_CONFIGURATION or bus reset) while the system workqueue is still parsing host OUT data...