rootpwn

high · CVSS v3 7.1

CVE-2026-98018

A use-after-free vulnerability exists in the Linux kernel MCTP over I3C driver. It occurs when an I3C bus removal event races with device pr

Overview

A use-after-free vulnerability exists in the Linux kernel MCTP over I3C driver. It occurs when an I3C bus removal event races with device probing, allowing a freed bus pointer to be used. This matters because kernel memory corruption can affect system stability and security.

Description

In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctp_i3c_probe() drops busdevs_lock after finding the matching bus. A concurrent I3C_NOTIFY_BUS_REMOVE can then unregister and free the bus netdev before probe passes its private data to mctp_i3c_add_device(). The latter consequently adds a list node through a freed mbus pointer. Keep busdevs_lock held until the device has been added. This also satisfies the __must_hold annotation on mctp_i3c_add_device().

Impact

The flaw can corrupt kernel memory during a race between MCTP I3C probe and I3C bus removal. This may lead to denial of service or, in some environments, privilege escalation. Confidentiality and integrity may be affected if an attacker can influence I3C bus events or device attachment. Primary impact is on hosts with MCTP over I3C enabled, including embedded, management, or I3C-connected systems.

Remediation

Apply a kernel update containing the fix that keeps busdevs_lock held until the MCTP I3C device is fully added. If patching is delayed, disable the MCTP I3C driver or MCTP over I3C support if not required. Restrict physical and logical access to I3C buses and management interfaces. Monitor kernel logs for MCTP, I3C, or memory-corruption errors and apply vendor-provided kernel or firmware updates.

Risk context

Severity is high with CVSS v3 7.1, and no EPSS score is provided. Priority should be higher in environments where MCTP over I3C is enabled or where I3C bus events can be influenced. If MCTP I3C is not used, exposure is lower.

Affected products

  • Linux kernel
  • Linux MCTP I3C driver
  • Systems using MCTP over I3C

Scores

Severity
high
CVSS v2
5.6
CVSS v3
7.1
CVSS v4
—
EPSS
—

linux-kernel use-after-free mctp i3c race-condition memory-corruption

← All CVEs

Related CVEs

high

CVE-2026-98026

This vulnerability affects the Linux kernel's bridge multicast handling. An improper RCU usage can lead to premature freeing of port group structures, potentially causing memory corruption or crashes. The fix converts mglist to RCU and corrects initialization order.

View analysis

high

CVE-2026-98101

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() pmc->sflist is read locklessly under rcu_read_lock() by inet6_mc_check() during packet reception in the UDP and RAW multicast receive paths. ip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place when adding or removing a source filter. Additionally, when expanding the filter buffer, newpsl was published via rcu_assign_pointer() before writing the new source into the array. Because 16-byte struct in6_addr writes are not atomic and array shifting is not synchronized with RCU readers, concurrent readers in inet6_mc_check() could read torn IPv6 addresses or observe duplicated/missed source entries. Fix this by switching ip6_mc_source() to copy-on-write RCU updates: allocate and fully populate newpsl before publishing it via rcu_assign_pointer(), and reclaim the old filter via kfree_rcu(), matching ip6_mc_msfilter(). Also remove the now unused IP6_SFBLOCK macro.

View analysis

high

CVE-2026-97990

CVE-2026-97990 is a high‑severity flaw in the Linux kernel’s vdpa_sim_net driver that allows a negative TX pull result to be interpreted as a large positive length in the RX path. The bug can lead to memory corruption or denial of service when the kernel processes received packets. It was fixed by adding checks for non‑positive pull results before using the length.

View analysis

high

CVE-2026-97991

CVE-2026-97991 is a Linux kernel vulnerability affecting the vDPA block device driver. It allows out-of-range buffer offsets to be used in read/write operations, leading to potential memory corruption. The flaw can be triggered by VIRTIO_BLK_T_IN, VIRTIO_BLK_T_OUT, or VIRTIO_BLK_T_WRITE_ZEROES requests.

View analysis