HIGH Introduced in 6.7
mctp I3cBus UAF
CVE-2026-98018
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctp_i3c_probe() drops busdevs_lock after finding the matching bus. A concurrent I3C_NOTIFY_BUS_REMOVE can then unregister and free the bus netdev before probe passes its private data to mctp_i3c_add_device(). The latter consequently adds a list node through a freed mbus pointer. Keep busdevs_lock held until the device has been added. This also satisfies the __must_hold annotation on mctp_i3c_add_device().
02KernelScan AI Analysis
Risk summary
A race condition in the MCTP I3C network transport driver allows the I3C bus structure to be freed while a concurrent device probe still references it, resulting in a use-after-free with kernel heap memory corruption. Systems with I3C hardware configured as an MCTP controller are affected; a local attacker who can time I3C bus removal against device enumeration can trigger the vulnerability.
Vulnerability analysis
The MCTP I3C driver has a race condition where a bus lookup releases its lock before the bus pointer is used to add a new device. If the I3C bus is removed concurrently — triggered by a local hardware event or driver unbind — the bus structure can be freed while the probe function still holds and dereferences the stale pointer, resulting in a use-after-free that corrupts kernel heap memory. The fix keeps the lock held across the entire device-addition operation so the bus cannot be torn down mid-probe. The vulnerable path is reached locally on systems with I3C hardware configured as an MCTP controller, and the race can be triggered by timing I3C bus removal against device enumeration.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.7 | 6.12.111 | e6541b274768 |
| 6.18 | 6.7 | 6.18.53 | 765c5e357e67 |
| 7.2 | 6.7 | 7.2.7 | 906d8dbafabf |
| mainline | 6.7 | 7.3 | 2b4707a149a5 |
| cip/6.12 | 6.7 | 6.12.111-cip32 | e6541b274768 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |