The vulnerability is a NULL pointer dereference within the MCTP-over‑I2C+GPIO target binding logic of Zephyr’s MCTP subsystem. Because the internal register state is not reset after an I²C STOP, an attacker that can send packets on the shared management bus can cause the target to invoke the MCTP driver with a NULL packet. The benign read or write sequence leaves a stale register selected, leading to a fatal exception in the interrupt handler. The resulting device reset or halt merely denies service; no information is leaked or data is corrupted. The threat is limited to a local denial of service. This inference is based on the lack of any confidentiality or integrity impact described. The attacker must control a peer device on the same I²C bus; this is inferred from the statement that any device able to act as controller can trigger the flaw.

This flaw affects Zephyr RTOS builds that enable the experimental MCTP I2C+GPIO target (CONFIG_MCTP subsystem with CONFIG_MCTP_I2C_GPIO_TARGET=y). All devices carrying that configuration are vulnerable, regardless of the Zephyr version, until the fix that clears the register on every stop is applied. Systems that have disabled the experimental MCTP target or are not compiling the target code are not impacted. This is inferred from the note that only builds with that config are affected.

The CVSS base score of 7.1 reflects medium to high severity, and the EPSS score is not available, implying the probability of exploitation may be low but not negligible. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only two ordinary I2C transactions, no firmware or privileged access beyond control of a peer endpoint on the same I²C bus. The attacker could be a compromised firmware on a peer MCTP endpoint or a malicious BMC; this is inferred from the description that any device able to act as controller can trigger the flaw. The impact is limited to a local denial of service without leaking sensitive data.