All vulnerabilities
CVE-2026-98018

Linux: net: mctp: i3c: serialize probe with bus removal

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in765c5e357e67916a7aac8ead4ac2fa7d2bffe000Also 906d8dbafabfa81a30e3ade420cb9912f223a5e1, 2b4707a149a55e8fa75c9ef32b359d60f470a566CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 765c5e357e67916a7aac8ead4ac2fa7d2bffe000LinuxCVE List
  • 906d8dbafabfa81a30e3ade420cb9912f223a5e1LinuxCVE List
  • 2b4707a149a55e8fa75c9ef32b359d60f470a566LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: i3c: serialize probe with bus removal

mctp_i3c_probe() drops busdevs_lock after finding the matching bus. A concurrent I3C_NOTIFY_BUS_REMOVE can then unregister and free the bus netdev before probe passes its private data to mctp_i3c_add_device(). The latter consequently adds a list node through a freed mbus pointer.

Keep busdevs_lock held until the device has been added. This also satisfies the __must_hold annotation on mctp_i3c_add_device().

Text from CVE List

Affected versions 10

  • Linuxaffected: c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 before e6541b2747682fdb2c6ded4a7cf7c39c4067a35cCVE List
  • Linuxaffected: c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 before 765c5e357e67916a7aac8ead4ac2fa7d2bffe000CVE List
  • Linuxaffected: c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 before 906d8dbafabfa81a30e3ade420cb9912f223a5e1CVE List
  • Linuxaffected: c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 before 2b4707a149a55e8fa75c9ef32b359d60f470a566CVE List
  • Linuxaffected: 6.7CVE List
  • Linuxunaffected: all versions before 6.7CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4