CVE-2026-98018

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the MCTP I3C implementation where the mctp i3c probe() function releases the busdevs lock prematurely after locating a matching bus. If a concurrent I3C NOTIFY BUS REMOVE event occurs, the bus netdev can be unregistered and freed before the probe process passes its private data to the mctp i3c add device() function. This leads to the addition of a list node using a freed mbus pointer, resulting in a use-after-free scenario.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.