« Volver al listado

CVE-2026-98018

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: i3c: serialize probe with bus removal

mctp_i3c_probe() drops busdevs_lock after finding the matching bus. A concurrent I3C_NOTIFY_BUS_REMOVE can then unregister and free the bus netdev before probe passes its private data to mctp_i3c_add_device(). The latter consequently adds a list node through a freed mbus pointer.

Keep busdevs_lock held until the device has been added. This also satisfies the __must_hold annotation on mctp_i3c_add_device().

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98018",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5",
              "lessThan": "e6541b2747682fdb2c6ded4a7cf7c39c4067a35c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5",
              "lessThan": "765c5e357e67916a7aac8ead4ac2fa7d2bffe000",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5",
              "lessThan": "906d8dbafabfa81a30e3ade420cb9912f223a5e1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5",
              "lessThan": "2b4707a149a55e8fa75c9ef32b359d60f470a566",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/mctp/mctp-i3c.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.7",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/mctp/mctp-i3c.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:30.257",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2b4707a149a55e8fa75c9ef32b359d60f470a566",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/765c5e357e67916a7aac8ead4ac2fa7d2bffe000",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/906d8dbafabfa81a30e3ade420cb9912f223a5e1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e6541b2747682fdb2c6ded4a7cf7c39c4067a35c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mctp: i3c: serialize probe with bus removal\n\nmctp_i3c_probe() drops busdevs_lock after finding the matching bus. A\nconcurrent I3C_NOTIFY_BUS_REMOVE can then unregister and free the bus\nnetdev before probe passes its private data to mctp_i3c_add_device().\nThe latter consequently adds a list node through a freed mbus pointer.\n\nKeep busdevs_lock held until the device has been added. This also\nsatisfies the __must_hold annotation on mctp_i3c_add_device()."
    }
  ],
  "lastModified": "2026-09-25T11:17:30.257",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}