Executive brief
A vulnerability in the Linux kernel's MCTP I2C driver could allow a local user to read uninitialized memory from the system stack. MCTP is a protocol used for communication between components inside a computer, such as sensors or management controllers. While the impact is limited, it could potentially leak small amounts of sensitive internal system information to an unauthorized user.
Technical details
An information leak exists in the Linux kernel's MCTP I2C binding driver (drivers/net/mctp/mctp-i2c.c). The mctp_i2c_slave_cb function did not initialize the 'val' parameter during I2C_SLAVE_READ_REQUESTED and I2C_SLAVE_READ_PROCESSED events. On certain hardware like i2c-aspeed and i2c-npcm7xx, this results in the driver returning an uninitialized u8 from the stack to the I2C bus driver. A local attacker can exploit this by performing I2C reads on an MCTP-I2C instance to observe uninitialized kernel stack data. The issue has been resolved by explicitly setting the read value to 0xff.
Affected products
- Linux Linux Kernel f5b8abf9fc3d to fixed versions
Timeline
- 2026-01-13: other: Patch authored
- 2026-05-27: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/11f83253244060b5de5eac787f61ae3f3e559d01
- https://git.kernel.org/stable/c/1eeedb310229bfee9dd4d992e5bba33fe1378a8f
- https://git.kernel.org/stable/c/2a14e91b6d76639dac70ea170f4384c1ee3cb48d
- https://git.kernel.org/stable/c/6ff2ebfef75fbc57d937d8fbe738b967edf2d331
- https://git.kernel.org/stable/c/93e01e837e105299f1c259ef71f6e1ec4fe806e3
- https://git.kernel.org/stable/c/fa9861e5c8af7651dddfa8d490aaada17ae33b6c