{"api_version":"1","generated_at":"2026-08-18T13:35:38+00:00","cve":"CVE-2026-68314","urls":{"html":"https://cve.report/CVE-2026-68314","api":"https://cve.report/api/cve/CVE-2026-68314.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68314","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68314"},"summary":{"title":"net: mctp i3c: clean up notifier and buses if driver register fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mctp i3c: clean up notifier and buses if driver register fails\n\nmctp_i3c_mod_init() registers the I3C bus notifier and then walks the\nexisting buses with i3c_for_each_bus_locked(mctp_i3c_bus_add_new, NULL)\nbefore registering the I3C device driver.  If i3c_driver_register()\nfails, the function returns the error directly, leaving the notifier\nregistered and every mctp_i3c_bus object created for the existing buses\nallocated.  The notifier is left pointing into the module that failed to\nload and the bus list is leaked.\n\nMirror the module exit path on this failure: unregister the notifier and\ntear down the buses that were added before returning the error.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:21","updated_at":"2026-08-17 05:18:34"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/49d15cfab247c0f60ce1800bdcd66850beea7b3a","name":"https://git.kernel.org/stable/c/49d15cfab247c0f60ce1800bdcd66850beea7b3a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a40e83a34eaa2be64372286040696f04eabcd09f","name":"https://git.kernel.org/stable/c/a40e83a34eaa2be64372286040696f04eabcd09f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/03d1057305ef17ac3f5936ac1580bc9a1a826e14","name":"https://git.kernel.org/stable/c/03d1057305ef17ac3f5936ac1580bc9a1a826e14","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a8bd8c109da5a87f0c5db0c23cf550d039fde77c","name":"https://git.kernel.org/stable/c/a8bd8c109da5a87f0c5db0c23cf550d039fde77c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68314","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68314","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 49d15cfab247c0f60ce1800bdcd66850beea7b3a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 a8bd8c109da5a87f0c5db0c23cf550d039fde77c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 a40e83a34eaa2be64372286040696f04eabcd09f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 03d1057305ef17ac3f5936ac1580bc9a1a826e14 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.7","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.7 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.101 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68314","cve":"CVE-2026-68314","epss":"0.001280000","percentile":"0.029170000","score_date":"2026-08-17","updated_at":"2026-08-18 00:11:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/mctp/mctp-i3c.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"49d15cfab247c0f60ce1800bdcd66850beea7b3a","status":"affected","version":"c8755b29b58ec65be17bcb8c40763d2dcb1f1db5","versionType":"git"},{"lessThan":"a8bd8c109da5a87f0c5db0c23cf550d039fde77c","status":"affected","version":"c8755b29b58ec65be17bcb8c40763d2dcb1f1db5","versionType":"git"},{"lessThan":"a40e83a34eaa2be64372286040696f04eabcd09f","status":"affected","version":"c8755b29b58ec65be17bcb8c40763d2dcb1f1db5","versionType":"git"},{"lessThan":"03d1057305ef17ac3f5936ac1580bc9a1a826e14","status":"affected","version":"c8755b29b58ec65be17bcb8c40763d2dcb1f1db5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/mctp/mctp-i3c.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.101","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"6.7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mctp i3c: clean up notifier and buses if driver register fails\n\nmctp_i3c_mod_init() registers the I3C bus notifier and then walks the\nexisting buses with i3c_for_each_bus_locked(mctp_i3c_bus_add_new, NULL)\nbefore registering the I3C device driver.  If i3c_driver_register()\nfails, the function returns the error directly, leaving the notifier\nregistered and every mctp_i3c_bus object created for the existing buses\nallocated.  The notifier is left pointing into the module that failed to\nload and the bus list is leaked.\n\nMirror the module exit path on this failure: unregister the notifier and\ntear down the buses that were added before returning the error.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The stale notifier and leftover mctpi3cN netdevs are reached from the local system — an AF_MCTP socket transmit or a local I3C bus hotplug event — not from any remote or adjacent network peer.\nAC:L - Once module init has failed, the leftover state is deterministic and any local user can drive traffic into the freed module's netdev ops or wait for a bus event with no additional conditions to win.\nPR:L - After the failed load leaves the interfaces registered, an ordinary unprivileged user can open an AF_MCTP socket and send on the stale mctpi3cN interface, dereferencing function pointers in freed module memory without any capability.\nUI:N - No victim action is needed; the leftover netdevs and notifier are globally visible and can be exercised directly by the attacker or by ordinary I3C bus events.\nS:U - The stale pointers and leaked objects are all kernel-side resources within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Execution against freed module text/data is a use-after-free of a region that can be reclaimed and shaped by the attacker, permitting disclosure of arbitrary kernel memory contents through the reused allocation.\nI:H - Calling through notifier_call and netdev_ops pointers residing in freed module memory yields control-flow hijack once that memory is reallocated, giving an arbitrary write / code execution primitive.\nA:H - Even without successful reclamation, invoking the stale notifier or the leftover netdev's ops jumps into unmapped or reused memory and reliably oopses/panics the kernel; the leaked netdevs and kthread are also never freed."}]}],"providerMetadata":{"dateUpdated":"2026-08-17T05:03:10.989Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/49d15cfab247c0f60ce1800bdcd66850beea7b3a"},{"url":"https://git.kernel.org/stable/c/a8bd8c109da5a87f0c5db0c23cf550d039fde77c"},{"url":"https://git.kernel.org/stable/c/a40e83a34eaa2be64372286040696f04eabcd09f"},{"url":"https://git.kernel.org/stable/c/03d1057305ef17ac3f5936ac1580bc9a1a826e14"}],"title":"net: mctp i3c: clean up notifier and buses if driver register fails","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68314","datePublished":"2026-08-10T12:02:49.124Z","dateReserved":"2026-07-30T09:28:09.382Z","dateUpdated":"2026-08-17T05:03:10.989Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:21","lastModifiedDate":"2026-08-17 05:18:34","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68314","Ordinal":"1","Title":"net: mctp i3c: clean up notifier and buses if driver register fa","CVE":"CVE-2026-68314","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68314","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mctp i3c: clean up notifier and buses if driver register fails\n\nmctp_i3c_mod_init() registers the I3C bus notifier and then walks the\nexisting buses with i3c_for_each_bus_locked(mctp_i3c_bus_add_new, NULL)\nbefore registering the I3C device driver.  If i3c_driver_register()\nfails, the function returns the error directly, leaving the notifier\nregistered and every mctp_i3c_bus object created for the existing buses\nallocated.  The notifier is left pointing into the module that failed to\nload and the bus list is leaked.\n\nMirror the module exit path on this failure: unregister the notifier and\ntear down the buses that were added before returning the error.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code.","Type":"Description","Title":"net: mctp i3c: clean up notifier and buses if driver register fa"}]}}}