CVE-2026-68124 - Vulnerability Details

- mctp: serial: handle zero-length frames to prevent rx buffer overflow

Description

In the Linux kernel, the following vulnerability has been resolved:

mctp: serial: handle zero-length frames to prevent rx buffer overflow

The MCTP serial receive state machine reads a frame length byte in
mctp_serial_push_header() case 2 and validates it upper-bound-only:

if (c > MCTP_SERIAL_FRAME_MTU) {
dev->rxstate = STATE_ERR;
} else {
dev->rxlen = c;
dev->rxpos = 0;
dev->rxstate = STATE_DATA;
...
}

A length of zero passes this check, so rxlen is set to 0 and the state
machine advances to STATE_DATA. In mctp_serial_push() STATE_DATA, the
incoming byte is stored and rxpos incremented before the terminator is

dev->rxbuf[dev->rxpos] = c;
dev->rxpos++;
dev->rxstate = STATE_DATA;
if (dev->rxpos == dev->rxlen) {
dev->rxpos = 0;
dev->rxstate = STATE_TRAILER;
}

With rxlen == 0 the "rxpos == rxlen" terminator can never fire (rxpos is
already 1 on the first data byte), so subsequent bytes are written past
the end of the fixed 74-byte rxbuf, which is the last member of the
netdev private area. Every following data byte is an attacker-controlled
1-byte out-of-bounds heap write, and the overflow continues until a
frame (0x7e) or escape byte resets the parser -- effectively unbounded.

Reaching this requires CAP_NET_ADMIN to attach the N_MCTP line
discipline and bring the resulting mctpserialN netdev up, after which
the bytes arrive via the tty receive path.

Route a zero-length frame straight to STATE_TRAILER instead of
STATE_DATA. The trailer/framing bytes are still consumed, and the frame
resolves to a zero-length skb that the MCTP core rejects; the parser
never enters STATE_DATA with rxlen == 0, so the out-of-bounds write can
no longer occur.

KASAN, on a frame of 0x7e 0x01 0x00 followed by data bytes (before this
change):

UBSAN: array-index-out-of-bounds in drivers/net/mctp/mctp-serial.c:370
index 74 is out of range for type 'u8 [74]'
BUG: KASAN: slab-out-of-bounds in mctp_serial_tty_receive_buf
Write of size 1 at addr ... by task kworker/u16:0
mctp_serial_tty_receive_buf
tty_ldisc_receive_buf
flush_to_ldisc
Allocated by task 152:
alloc_netdev_mqs
mctp_serial_open

v2: route zero-length frames to STATE_TRAILER instead of STATE_ERR so
the trailer/framing bytes are still consumed (Jeremy Kerr).

Found by 0sec automated security-research tooling (https://0sec.ai).

Published: 2026-08-10

Score: 9.6 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The MCTP serial driver in the Linux kernel accepts a zero‑length frame and incorrectly transitions to the data state while the recorded frame length is zero. A subsequent byte stored in the 74‑byte receive buffer immediately exceeds the buffer’s bounds, causing an out‑of‑bounds heap write that continues until a terminating byte resets the parser. This overflow can corrupt arbitrary kernel memory and potentially lead to denial of service or privilege escalation if an attacker can influence the content of the overflowed bytes.

Affected Systems

All Linux kernel configurations that include the MCTP serial driver prior to the security fix. The vulnerability is present in the mainline kernel and is not confined to a particular distribution. The patch that resolves the issue is identified by commit 06a6b606129c8a25cd457760f5370f3ff01fe05d and subsequent commits.

Risk and Exploitability

Reaching the flaw requires CAP_NET_ADMIN to attach the N_MCTP line discipline and bring the resulting mctpserialN netdev up. After that, an attacker can send crafted frames over the tty receive path. The vulnerability is therefore limited to privileged users or processes that can grant the required capability. The CVSS score of 9.6, the EPSS score of <1%, and the absence from CISA KEV indicate that while the flaw has high severity, exploitation chances are low. Nonetheless, untrusted administrators or compromised privileged users could trigger the overflow, potentially affecting kernel integrity and leading to privilege escalation or system crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd`	affected	< 64b96ae7912244d55257aa330d9569ee0a8f8d99
`a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd`	affected	< 36dc6d6964a3b90411cc7944cd9b8b6f67b9807b
`a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd`	affected	< 68819427bc07eca7963a9e8be19e5272cc29186c
`a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd`	affected	< f80ba170d7b3a44e3d244a2c8e06031d61bf3b23
`a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd`	affected	< 06a6b606129c8a25cd457760f5370f3ff01fe05d
`a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd`	affected	< 793b9b729f1e8de57be8c8daf1a9838be96cabed

Linux

affected

Version	Status	Constraints
`5.17`	affected	—
`0`	unaffected	< 5.17
`6.1.183`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd,36dc6d6964a3b90411cc7944cd9b8b6f67b9807b)`	affected	code_commit	—
`[a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd,68819427bc07eca7963a9e8be19e5272cc29186c)`	affected	code_commit	—
`[a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd,f80ba170d7b3a44e3d244a2c8e06031d61bf3b23)`	affected	code_commit	—
`[a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd,06a6b606129c8a25cd457760f5370f3ff01fe05d)`	affected	code_commit	—
`[a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd,793b9b729f1e8de57be8c8daf1a9838be96cabed)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.17`	affected	generic	—
`[0,5.17)`	unaffected	generic	—
`[6.6.148,6.7.0)`	unaffected	generic	—
`[6.12.101,6.13.0)`	unaffected	generic	—
`[6.18.42,6.19.0)`	unaffected	generic	—
`[7.1.6,7.2.0)`	unaffected	generic	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version containing the MCTP serial driver fix (commit 06a6b606129c8a25cd457760f5370f3ff01fe05d or later).
If an immediate kernel update is not feasible, disable or unload the mctpserial module or block attachment of the N_MCTP line discipline so that no MCTP serial devices can be created.
Restrict CAP_NET_ADMIN privileges to trusted users or processes and enforce strict role‑based access controls to prevent unauthorized creation of new network devices.

Generated by OpenCVE AI on August 14, 2026 at 03:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00348.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/06a6b606129c8a25cd457760f5370f3ff01fe05d
https://git.kernel.org/stable/c/36dc6d6964a3b90411cc7944cd9b8b6f67b9807b
https://git.kernel.org/stable/c/64b96ae7912244d55257aa330d9569ee0a8f8d99
https://git.kernel.org/stable/c/68819427bc07eca7963a9e8be19e5272cc29186c
https://git.kernel.org/stable/c/793b9b729f1e8de57be8c8daf1a9838be96cabed
https://git.kernel.org/stable/c/f80ba170d7b3a44e3d244a2c8e06031d61bf3b23
https://lore.kernel.org/linux-cve-announce/2026081056-CVE-2026-68124-575b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-68124
https://www.cve.org/CVERecord?id=CVE-2026-68124

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/64b96ae7912244d55257aa330d9569ee0a8f8d99

Fri, 14 Aug 2026 02:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-122

Thu, 13 Aug 2026 22:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081056-CVE-2026-68124-575b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-68124 https://www.cve.org/CVERecord?id=CVE-2026-68124

Mon, 10 Aug 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-122 CWE-787

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctp_serial_push_header() case 2 and validates it upper-bound-only: if (c > MCTP_SERIAL_FRAME_MTU) { dev->rxstate = STATE_ERR; } else { dev->rxlen = c; dev->rxpos = 0; dev->rxstate = STATE_DATA; ... } A length of zero passes this check, so rxlen is set to 0 and the state machine advances to STATE_DATA. In mctp_serial_push() STATE_DATA, the incoming byte is stored and rxpos incremented before the terminator is dev->rxbuf[dev->rxpos] = c; dev->rxpos++; dev->rxstate = STATE_DATA; if (dev->rxpos == dev->rxlen) { dev->rxpos = 0; dev->rxstate = STATE_TRAILER; } With rxlen == 0 the "rxpos == rxlen" terminator can never fire (rxpos is already 1 on the first data byte), so subsequent bytes are written past the end of the fixed 74-byte rxbuf, which is the last member of the netdev private area. Every following data byte is an attacker-controlled 1-byte out-of-bounds heap write, and the overflow continues until a frame (0x7e) or escape byte resets the parser -- effectively unbounded. Reaching this requires CAP_NET_ADMIN to attach the N_MCTP line discipline and bring the resulting mctpserialN netdev up, after which the bytes arrive via the tty receive path. Route a zero-length frame straight to STATE_TRAILER instead of STATE_DATA. The trailer/framing bytes are still consumed, and the frame resolves to a zero-length skb that the MCTP core rejects; the parser never enters STATE_DATA with rxlen == 0, so the out-of-bounds write can no longer occur. KASAN, on a frame of 0x7e 0x01 0x00 followed by data bytes (before this change): UBSAN: array-index-out-of-bounds in drivers/net/mctp/mctp-serial.c:370 index 74 is out of range for type 'u8 [74]' BUG: KASAN: slab-out-of-bounds in mctp_serial_tty_receive_buf Write of size 1 at addr ... by task kworker/u16:0 mctp_serial_tty_receive_buf tty_ldisc_receive_buf flush_to_ldisc Allocated by task 152: alloc_netdev_mqs mctp_serial_open v2: route zero-length frames to STATE_TRAILER instead of STATE_ERR so the trailer/framing bytes are still consumed (Jeremy Kerr). Found by 0sec automated security-research tooling (https://0sec.ai).
Title		mctp: serial: handle zero-length frames to prevent rx buffer overflow
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/06a6b606129c8a25cd457760f5370f3ff01fe05d https://git.kernel.org/stable/c/36dc6d6964a3b90411cc7944cd9b8b6f67b9807b https://git.kernel.org/stable/c/68819427bc07eca7963a9e8be19e5272cc29186c https://git.kernel.org/stable/c/793b9b729f1e8de57be8c8daf1a9838be96cabed https://git.kernel.org/stable/c/f80ba170d7b3a44e3d244a2c8e06031d61bf3b23

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T11:58:44.997Z

Updated: 2026-08-19T16:29:36.851Z

Reserved: 2026-07-30T09:28:09.369Z

Link: CVE-2026-68124

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:19:57.550

Modified: 2026-08-19T17:20:29.847

Link: CVE-2026-68124

Redhat

Severity :

Publid Date: 2026-08-10T00:00:00Z

Links: CVE-2026-68124 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-14T04:00:12Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object