Executive brief
A memory leak vulnerability exists in the Linux kernel's Management Component Transport Protocol (MCTP) over I2C. This component is used for communication between hardware components like sensors or controllers. An attacker could exploit this to gradually consume system memory, potentially leading to a system crash or service outage.
Technical details
A memory leak (CWE-401) exists in the mctp-i2c driver within the Linux kernel. When the 'allow_rx' flag is set to false in the 'mctp_i2c_recv' function, the driver fails to free a newly allocated socket buffer (skb) that is not consumed by the 'netif_rx()' function. A local attacker can trigger this path to exhaust system memory over time, resulting in a denial of service. The issue has been resolved by explicitly calling 'kfree_skb(skb)' when reception is dropped. Patches are available for multiple stable kernel branches including 6.1, 6.6, 6.12, 6.18, and 6.19.
Affected products
- Linux Linux Kernel 5.18 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-03-05: other: Patch submitted by author
- 2026-05-08: disclosed: CVE published
- 2026-05-21: advisory: NVD enrichment and analysis completed
References
- https://git.kernel.org/stable/c/0fb2adbdd5c03e8c9ebcdc48afd414b2724c85eb
- https://git.kernel.org/stable/c/1b1be322342a6b0085bf6ee52235e5ac9834ec25
- https://git.kernel.org/stable/c/1ec54187e1aa40a4cfa2b265e9a311179f24b98d
- https://git.kernel.org/stable/c/9f81be2ab9d8e4744871bfb3e868ef413413829f
- https://git.kernel.org/stable/c/d7900a43b0a314a645ca0a2adf45928dbc7001f4
- https://git.kernel.org/stable/c/e3f5e0f22cfc2371e7471c9fd5b4da78f9df7c69