CVE-2026-98018 - Vulnerability Details

- net: mctp: i3c: serialize probe with bus removal

Description

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: i3c: serialize probe with bus removal

mctp_i3c_probe() drops busdevs_lock after finding the matching bus. A
concurrent I3C_NOTIFY_BUS_REMOVE can then unregister and free the bus
netdev before probe passes its private data to mctp_i3c_add_device().
The latter consequently adds a list node through a freed mbus pointer.

Keep busdevs_lock held until the device has been added. This also
satisfies the __must_hold annotation on mctp_i3c_add_device().

Published: 2026-09-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux MCTP I3C driver releases the bus lock too early during probe, allowing a concurrent I3C_NOTIFY_BUS_REMOVE to unregister and free the network device while the probe still processes it. The add‑device routine receives a pointer to the freed bus and adds a list node, causing a use‑after‑free that corrupts kernel memory.

Affected Systems

All Linux kernels that contain the unpatched MCTP I3C driver, namely any kernel release prior to the commit that applies the busdevs_lock fix. Various distributions ship these kernels in their default packages until the patch is merged into the upstream tree and propagated by maintainers.

Risk and Exploitability

The vulnerability has a CVSS score of 5.5 and an EPSS score of < 1%, indicating a moderate severity and a low likelihood of widespread exploitation. It is not listed in CISA’s KEV catalog. Exploitation requires local control or a malicious device driver to trigger the bus removal race while another driver is probing. If successful, kernel memory corruption can lead to privilege escalation, arbitrary code execution or a denial‑of‑service kernel panic.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c8755b29b58ec65be17bcb8c40763d2dcb1f1db5`	affected	< e6541b2747682fdb2c6ded4a7cf7c39c4067a35c
`c8755b29b58ec65be17bcb8c40763d2dcb1f1db5`	affected	< 765c5e357e67916a7aac8ead4ac2fa7d2bffe000
`c8755b29b58ec65be17bcb8c40763d2dcb1f1db5`	affected	< 906d8dbafabfa81a30e3ade420cb9912f223a5e1
`c8755b29b58ec65be17bcb8c40763d2dcb1f1db5`	affected	< 2b4707a149a55e8fa75c9ef32b359d60f470a566

Linux

affected

Version	Status	Constraints
`6.7`	affected	—
`0`	unaffected	< 6.7
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c8755b29b58ec65be17bcb8c40763d2dcb1f1db5, e6541b2747682fdb2c6ded4a7cf7c39c4067a35c)`	affected	code_commit	—
`[c8755b29b58ec65be17bcb8c40763d2dcb1f1db5, 765c5e357e67916a7aac8ead4ac2fa7d2bffe000)`	affected	code_commit	—
`[c8755b29b58ec65be17bcb8c40763d2dcb1f1db5, 906d8dbafabfa81a30e3ade420cb9912f223a5e1)`	affected	code_commit	—
`[c8755b29b58ec65be17bcb8c40763d2dcb1f1db5, 2b4707a149a55e8fa75c9ef32b359d60f470a566)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.7`	affected	generic	—
`[0,6.7)`	unaffected	generic	—
`[6.12.111,6.12.*]`	unaffected	generic	—
`[6.18.53,6.18.*]`	unaffected	generic	—
`[7.2.7,7.2.*]`	unaffected	generic	—
`[7.3-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patch for the MCTP I3C driver race condition
If the MCTP or I3C interfaces are not required, disable the driver or its modules via kernel boot parameters or module options
Monitor system logs for I3C bus removal errors or kernel OOPS messages and apply the update promptly

Generated by OpenCVE AI on October 1, 2026 at 04:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98018.mbox
https://git.kernel.org/stable/c/2b4707a149a55e8fa75c9ef32b359d60f470a566
https://git.kernel.org/stable/c/765c5e357e67916a7aac8ead4ac2fa7d2bffe000
https://git.kernel.org/stable/c/906d8dbafabfa81a30e3ade420cb9912f223a5e1
https://git.kernel.org/stable/c/e6541b2747682fdb2c6ded4a7cf7c39c4067a35c
https://nvd.nist.gov/vuln/detail/CVE-2026-98018
https://www.cve.org/CVERecord?id=CVE-2026-98018

History

Wed, 30 Sep 2026 15:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Tue, 29 Sep 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98018.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98018 https://www.cve.org/CVERecord?id=CVE-2026-98018
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 25 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 25 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctp_i3c_probe() drops busdevs_lock after finding the matching bus. A concurrent I3C_NOTIFY_BUS_REMOVE can then unregister and free the bus netdev before probe passes its private data to mctp_i3c_add_device(). The latter consequently adds a list node through a freed mbus pointer. Keep busdevs_lock held until the device has been added. This also satisfies the __must_hold annotation on mctp_i3c_add_device().
Title		net: mctp: i3c: serialize probe with bus removal
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2b4707a149a55e8fa75c9ef32b359d60f470a566 https://git.kernel.org/stable/c/765c5e357e67916a7aac8ead4ac2fa7d2bffe000 https://git.kernel.org/stable/c/906d8dbafabfa81a30e3ade420cb9912f223a5e1 https://git.kernel.org/stable/c/e6541b2747682fdb2c6ded4a7cf7c39c4067a35c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:23:39.706Z

Updated: 2026-10-19T09:12:23.555Z

Reserved: 2026-09-25T10:19:56.069Z

Link: CVE-2026-98018

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:30.257

Modified: 2026-10-19T10:17:55.673

Link: CVE-2026-98018

Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-98018 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-01T04:15:16Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object