CVE-2026-68314
Received Received - Intake

Memory Leak in Linux Kernel MCTP I3C Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctp_i3c_mod_init() registers the I3C bus notifier and then walks the existing buses with i3c_for_each_bus_locked(mctp_i3c_bus_add_new, NULL) before registering the I3C device driver. If i3c_driver_register() fails, the function returns the error directly, leaving the notifier registered and every mctp_i3c_bus object created for the existing buses allocated. The notifier is left pointing into the module that failed to load and the bus list is leaked. Mirror the module exit path on this failure: unregister the notifier and tear down the buses that were added before returning the error. This issue was identified during our ongoing static-analysis research while reviewing kernel code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68314
EUVD
EUVD-2026-55415

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel occurs when the MCTP I3C driver fails to register properly. During initialization, the driver registers a notifier and processes existing buses before attempting to register the device driver. If the driver registration fails, the notifier remains registered and buses are leaked, causing memory and resource leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's MCTP over I3C driver. Detection requires checking if the kernel module mctp_i3c is loaded and if the driver registration fails during boot or module load. Check kernel logs for errors during driver initialization.

Impact Analysis

This vulnerability could lead to system instability due to resource leaks. The leaked notifier and buses may consume memory and system resources over time, potentially causing performance degradation or crashes. It primarily affects systems using MCTP over I3C buses.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If using a custom kernel, ensure the mctp_i3c driver is properly handling registration failures by cleaning up notifiers and buses on failure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68314. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart