CVE-2026-68314 (GCVE-0-2026-68314)
Vulnerability from cvelistv5
Published
2026-08-10 12:02
Modified
2026-08-17 05:03
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: mctp i3c: clean up notifier and buses if driver register fails
mctp_i3c_mod_init() registers the I3C bus notifier and then walks the
existing buses with i3c_for_each_bus_locked(mctp_i3c_bus_add_new, NULL)
before registering the I3C device driver. If i3c_driver_register()
fails, the function returns the error directly, leaving the notifier
registered and every mctp_i3c_bus object created for the existing buses
allocated. The notifier is left pointing into the module that failed to
load and the bus list is leaked.
Mirror the module exit path on this failure: unregister the notifier and
tear down the buses that were added before returning the error.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/mctp/mctp-i3c.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "49d15cfab247c0f60ce1800bdcd66850beea7b3a",
"status": "affected",
"version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5",
"versionType": "git"
},
{
"lessThan": "a8bd8c109da5a87f0c5db0c23cf550d039fde77c",
"status": "affected",
"version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5",
"versionType": "git"
},
{
"lessThan": "a40e83a34eaa2be64372286040696f04eabcd09f",
"status": "affected",
"version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5",
"versionType": "git"
},
{
"lessThan": "03d1057305ef17ac3f5936ac1580bc9a1a826e14",
"status": "affected",
"version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/mctp/mctp-i3c.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mctp i3c: clean up notifier and buses if driver register fails\n\nmctp_i3c_mod_init() registers the I3C bus notifier and then walks the\nexisting buses with i3c_for_each_bus_locked(mctp_i3c_bus_add_new, NULL)\nbefore registering the I3C device driver. If i3c_driver_register()\nfails, the function returns the error directly, leaving the notifier\nregistered and every mctp_i3c_bus object created for the existing buses\nallocated. The notifier is left pointing into the module that failed to\nload and the bus list is leaked.\n\nMirror the module exit path on this failure: unregister the notifier and\ntear down the buses that were added before returning the error.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The stale notifier and leftover mctpi3cN netdevs are reached from the local system \u2014 an AF_MCTP socket transmit or a local I3C bus hotplug event \u2014 not from any remote or adjacent network peer.\nAC:L - Once module init has failed, the leftover state is deterministic and any local user can drive traffic into the freed module\u0027s netdev ops or wait for a bus event with no additional conditions to win.\nPR:L - After the failed load leaves the interfaces registered, an ordinary unprivileged user can open an AF_MCTP socket and send on the stale mctpi3cN interface, dereferencing function pointers in freed module memory without any capability.\nUI:N - No victim action is needed; the leftover netdevs and notifier are globally visible and can be exercised directly by the attacker or by ordinary I3C bus events.\nS:U - The stale pointers and leaked objects are all kernel-side resources within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Execution against freed module text/data is a use-after-free of a region that can be reclaimed and shaped by the attacker, permitting disclosure of arbitrary kernel memory contents through the reused allocation.\nI:H - Calling through notifier_call and netdev_ops pointers residing in freed module memory yields control-flow hijack once that memory is reallocated, giving an arbitrary write / code execution primitive.\nA:H - Even without successful reclamation, invoking the stale notifier or the leftover netdev\u0027s ops jumps into unmapped or reused memory and reliably oopses/panics the kernel; the leaked netdevs and kthread are also never freed."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:03:10.989Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/49d15cfab247c0f60ce1800bdcd66850beea7b3a"
},
{
"url": "https://git.kernel.org/stable/c/a8bd8c109da5a87f0c5db0c23cf550d039fde77c"
},
{
"url": "https://git.kernel.org/stable/c/a40e83a34eaa2be64372286040696f04eabcd09f"
},
{
"url": "https://git.kernel.org/stable/c/03d1057305ef17ac3f5936ac1580bc9a1a826e14"
}
],
"title": "net: mctp i3c: clean up notifier and buses if driver register fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68314",
"datePublished": "2026-08-10T12:02:49.124Z",
"dateReserved": "2026-07-30T09:28:09.382Z",
"dateUpdated": "2026-08-17T05:03:10.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…