CVE-2026-68314 (GCVE-0-2026-68314)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:02 – Updated: 2026-08-17 05:03
VLAI
Title
net: mctp i3c: clean up notifier and buses if driver register fails
Summary
In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctp_i3c_mod_init() registers the I3C bus notifier and then walks the existing buses with i3c_for_each_bus_locked(mctp_i3c_bus_add_new, NULL) before registering the I3C device driver. If i3c_driver_register() fails, the function returns the error directly, leaving the notifier registered and every mctp_i3c_bus object created for the existing buses allocated. The notifier is left pointing into the module that failed to load and the bus list is leaked. Mirror the module exit path on this failure: unregister the notifier and tear down the buses that were added before returning the error. This issue was identified during our ongoing static-analysis research while reviewing kernel code.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 , < 49d15cfab247c0f60ce1800bdcd66850beea7b3a (git)
Affected: c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 , < a8bd8c109da5a87f0c5db0c23cf550d039fde77c (git)
Affected: c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 , < a40e83a34eaa2be64372286040696f04eabcd09f (git)
Affected: c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 , < 03d1057305ef17ac3f5936ac1580bc9a1a826e14 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/mctp/mctp-i3c.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "49d15cfab247c0f60ce1800bdcd66850beea7b3a",
              "status": "affected",
              "version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5",
              "versionType": "git"
            },
            {
              "lessThan": "a8bd8c109da5a87f0c5db0c23cf550d039fde77c",
              "status": "affected",
              "version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5",
              "versionType": "git"
            },
            {
              "lessThan": "a40e83a34eaa2be64372286040696f04eabcd09f",
              "status": "affected",
              "version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5",
              "versionType": "git"
            },
            {
              "lessThan": "03d1057305ef17ac3f5936ac1580bc9a1a826e14",
              "status": "affected",
              "version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/mctp/mctp-i3c.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mctp i3c: clean up notifier and buses if driver register fails\n\nmctp_i3c_mod_init() registers the I3C bus notifier and then walks the\nexisting buses with i3c_for_each_bus_locked(mctp_i3c_bus_add_new, NULL)\nbefore registering the I3C device driver.  If i3c_driver_register()\nfails, the function returns the error directly, leaving the notifier\nregistered and every mctp_i3c_bus object created for the existing buses\nallocated.  The notifier is left pointing into the module that failed to\nload and the bus list is leaked.\n\nMirror the module exit path on this failure: unregister the notifier and\ntear down the buses that were added before returning the error.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The stale notifier and leftover mctpi3cN netdevs are reached from the local system \u2014 an AF_MCTP socket transmit or a local I3C bus hotplug event \u2014 not from any remote or adjacent network peer.\nAC:L - Once module init has failed, the leftover state is deterministic and any local user can drive traffic into the freed module\u0027s netdev ops or wait for a bus event with no additional conditions to win.\nPR:L - After the failed load leaves the interfaces registered, an ordinary unprivileged user can open an AF_MCTP socket and send on the stale mctpi3cN interface, dereferencing function pointers in freed module memory without any capability.\nUI:N - No victim action is needed; the leftover netdevs and notifier are globally visible and can be exercised directly by the attacker or by ordinary I3C bus events.\nS:U - The stale pointers and leaked objects are all kernel-side resources within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Execution against freed module text/data is a use-after-free of a region that can be reclaimed and shaped by the attacker, permitting disclosure of arbitrary kernel memory contents through the reused allocation.\nI:H - Calling through notifier_call and netdev_ops pointers residing in freed module memory yields control-flow hijack once that memory is reallocated, giving an arbitrary write / code execution primitive.\nA:H - Even without successful reclamation, invoking the stale notifier or the leftover netdev\u0027s ops jumps into unmapped or reused memory and reliably oopses/panics the kernel; the leaked netdevs and kthread are also never freed."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:03:10.989Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/49d15cfab247c0f60ce1800bdcd66850beea7b3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8bd8c109da5a87f0c5db0c23cf550d039fde77c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a40e83a34eaa2be64372286040696f04eabcd09f"
        },
        {
          "url": "https://git.kernel.org/stable/c/03d1057305ef17ac3f5936ac1580bc9a1a826e14"
        }
      ],
      "title": "net: mctp i3c: clean up notifier and buses if driver register fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68314",
    "datePublished": "2026-08-10T12:02:49.124Z",
    "dateReserved": "2026-07-30T09:28:09.382Z",
    "dateUpdated": "2026-08-17T05:03:10.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68314",
      "date": "2026-08-26",
      "epss": "0.00129",
      "percentile": "0.02739"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68314\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:21.307\",\"lastModified\":\"2026-08-17T05:18:34.267\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: mctp i3c: clean up notifier and buses if driver register fails\\n\\nmctp_i3c_mod_init() registers the I3C bus notifier and then walks the\\nexisting buses with i3c_for_each_bus_locked(mctp_i3c_bus_add_new, NULL)\\nbefore registering the I3C device driver.  If i3c_driver_register()\\nfails, the function returns the error directly, leaving the notifier\\nregistered and every mctp_i3c_bus object created for the existing buses\\nallocated.  The notifier is left pointing into the module that failed to\\nload and the bus list is leaked.\\n\\nMirror the module exit path on this failure: unregister the notifier and\\ntear down the buses that were added before returning the error.\\n\\nThis issue was identified during our ongoing static-analysis research while\\nreviewing kernel code.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/mctp/mctp-i3c.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c8755b29b58ec65be17bcb8c40763d2dcb1f1db5\",\"lessThan\":\"49d15cfab247c0f60ce1800bdcd66850beea7b3a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8755b29b58ec65be17bcb8c40763d2dcb1f1db5\",\"lessThan\":\"a8bd8c109da5a87f0c5db0c23cf550d039fde77c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8755b29b58ec65be17bcb8c40763d2dcb1f1db5\",\"lessThan\":\"a40e83a34eaa2be64372286040696f04eabcd09f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c8755b29b58ec65be17bcb8c40763d2dcb1f1db5\",\"lessThan\":\"03d1057305ef17ac3f5936ac1580bc9a1a826e14\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/mctp/mctp-i3c.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03d1057305ef17ac3f5936ac1580bc9a1a826e14\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/49d15cfab247c0f60ce1800bdcd66850beea7b3a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a40e83a34eaa2be64372286040696f04eabcd09f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a8bd8c109da5a87f0c5db0c23cf550d039fde77c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-08-11T12:31:49+00:00",
      "cve": "CVE-2026-68314",
      "id": "CVE-2026-68314",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: mctp i3c: clean up notifier and buses if driver register fails",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68314.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-11T23:48:16Z",
      "cve": "CVE-2026-68314",
      "id": "CVE-2026-68314",
      "initial_release_date": "2026-08-11T23:48:16Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "267",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68314",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68314.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.