CVE-2026-85032 Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress

The MCTP over USB device class in subsys/pmci/mctp/mctpusb.c splits RX handling across two threads: the system workqueue runs mctpusbclassoutwork, which parses host OUT data byte by byte and fills a packet buffer at usb-rxpkt, while the USB device stack thread runs mctpusbclassdisable. The disabl...

CVE-2026-85032

The MCTP subsystem in Zephyr (built with CONFIG_MCTP_USB) is vulnerable to a use-after-free condition in the mctp_usb.c binding. The issue occurs when mctp_usb_class_disable() is triggered by a USB host (via SET_CONFIGURATION or bus reset) while the system workqueue is still parsing host OUT data...