CVE-2026-85032

The MCTP over USB device class in subsys/pmci/mctp/mctp usb.c splits RX handling across two threads: the system workqueue runs mctp usb class out work(), which parses host OUT data byte by byte and fills a packet buffer at usb->rx pkt, while the USB device stack thread runs mctp usb class disable(). The disable handler used k work cancel(), which removes a queued work item but returns immediately without waiting for a handler that is already running, and then called mctp usb reset rx state() to mctp pktbuf free() the packet buffer the worker may still be using.

Both entry points into mctp usb class disable() are driven by the attached USB host: a SET CONFIGURATION request and a USB bus reset both reach it via usbd config reset() in subsys/usb/device next/usbd config.c. A host that streams partial MCTP frames on the bulk OUT endpoint and repeatedly forces a configuration change or bus reset therefore controls both the data being parsed and the moment the teardown runs, and can retry the race indefinitely without credentials or user interaction.

If the free lands while the worker holds the pointer, the worker writes host-supplied bytes into freed memory of the dedicated MCTP heap (CONFIG MCTP HEAP SIZE in subsys/pmci/mctp/mctp memory.c), corrupting recycled buffers or sys heap free-block metadata; this window requires genuine parallelism, i.e. CONFIG SMP or a preemptible CONFIG SYSTEM WORKQUEUE PRIORITY. With the default cooperative workqueue the worker can still yield inside mctp bus rx() (application callback or a control-message reply blocking in mctp usb tx()), after which it resumes and calls mctp pktbuf free(usb->rx pkt) on a pointer the teardown has NULLed, dereferencing NULL and faulting on targets with null-pointer detection.

The fix replaces the cancel with k work cancel sync() plus a new struct k work sync out work sync, so disable waits for the RX worker to finish before draining the FIFO and freeing the packet buffer. The affected code is the MCTP subsystem, which is marked experimental, built only with CONFIG MCTP USB.