CVE-2026-98018
Received Received - Intake

Race Condition in Linux Kernel MCTP I3C Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctp_i3c_probe() drops busdevs_lock after finding the matching bus. A concurrent I3C_NOTIFY_BUS_REMOVE can then unregister and free the bus netdev before probe passes its private data to mctp_i3c_add_device(). The latter consequently adds a list node through a freed mbus pointer. Keep busdevs_lock held until the device has been added. This also satisfies the __must_hold annotation on mctp_i3c_add_device().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98018
EUVD
EUVD-2026-86671

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition during device probing. The mctp_i3c_probe function releases a lock too early, allowing a concurrent bus removal operation to unregister and free the bus before the probe completes. This leads to a use-after-free scenario where a freed memory pointer is later accessed.

Detection Guidance

This vulnerability is specific to the Linux kernel's MCTP over I3C implementation. Detection requires checking kernel logs for crashes or errors related to mctp_i3c_probe or bus removal events. Commands like dmesg | grep mctp or journalctl -k | grep mctp may show issues. Ensure your kernel version is updated to a patched release.

Impact Analysis

This could cause system instability, crashes, or potential privilege escalation if exploited. Systems relying on the affected kernel components may experience unexpected behavior or security breaches due to memory corruption.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this CVE. If immediate patching is not possible, avoid using MCTP over I3C interfaces until the update is applied. Monitor kernel logs for related errors as a sign of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98018. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart