Executive brief
The MCTP serial driver in the Linux kernel fails to validate zero-length frame sizes, allowing an attacker with network administration privileges to trigger a heap buffer overflow. By sending specially crafted frames via the tty receive path, an attacker can write arbitrary data past a 74-byte buffer boundary, potentially enabling code execution or system compromise.
Technical details
The vulnerability is a heap-based buffer overflow in the MCTP serial driver's receive state machine. The driver reads a frame length byte but only validates the upper bound (checking if length > MCTP_SERIAL_FRAME_MTU), allowing zero-length frames to pass validation. When a zero-length frame is processed, the state machine transitions to STATE_DATA with rxlen=0, but subsequent incoming bytes are still written to the fixed 74-byte rxbuf array with rxpos incremented, causing unbounded out-of-bounds writes. Exploitation requires CAP_NET_ADMIN to attach the N_MCTP line discipline, after which crafted frames sent via the tty receive path trigger the overflow. The fix routes zero-length frames directly to STATE_TRAILER to skip STATE_DATA entry, preventing the out-of-bounds write while still consuming trailer/framing bytes.
Affected products
- Linux Linux kernel Multiple versions prior to fix (see patch)
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Fix routing zero-length frames to STATE_TRAILER instead of STATE_DATA