Technical impact
The kernel mod mctp/i2c contains a flaw where a newly allocated socket buffer is never freed when ‘midev->allow_rx’ is set to false. This causes a cumulative memory leak (CWE‑401) that can deplete kernel memory, potentially bringing the system to a halt. The defect does not directly expose information or facilitate code execution, but it can serve as a denial‑of‑service vector by exhausting critical system resources.
Affected Systems
All Linux kernel builds that include the mctp i2c driver before the patch, such as the default kernel shipped with most mainstream distributions. No specific vendor or version list is provided, so any system running an affected kernel version requires remediation.
Risk and Exploitability
Based on the description, it is inferred that the vulnerability is local; an attacker must be able to interface with the kernel’s mctp/i2c subsystem or inject traffic that triggers the receive path while ‘allow_rx’ is disabled. Although standard kernel access controls prevent arbitrary packet injection from user space, a compromised privileged process or a malicious I2C device could prove the condition. The EPSS score is < 1%, and the issue is not listed in KEV, but the potential for memory exhaustion makes the risk significant. With a CVSS score of 5.5, the vulnerability is of moderate severity. Immediate patching is advised to eliminate the leak.
Ubuntu USN