CVE-2026-79976

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp i2c gpio target.c fails to clear the selected register b->reg addr and the data-phase flag b->rxtx when an I2C STOP is issued. This allows a bus controller to trigger a null pointer dereference by performing a normal packet write to MCTP I2C GPIO RX MSG ADDR followed by a STOP, and then a bare read transaction followed by another STOP. This sequence causes mctp bus rx() to be called with a NULL packet. A similar issue exists on the transmit side where MCTP I2C GPIO TX MSG ADDR dereferences b->tx pkt->end after b->tx pkt has been cleared, potentially causing outbound packets to be dropped. This can lead to a denial of service via device reset or halt on targets that trap accesses to address 0, or result in malformed packet buffers and lost transmit packets on systems where address 0 is readable. This issue only affects builds using the experimental CONFIG MCTP subsystem with CONFIG MCTP I2C GPIO TARGET=y enabled.

Recommendations Update the affected Linux kernel to a version where b->reg addr is reset to MCTP I2C GPIO INVALID ADDR and b->rxtx is cleared at every STOP. As a temporary mitigation, disable the CONFIG MCTP I2C GPIO TARGET configuration option.