# CVE-2026-79976: Linux kernel MCTP-over-I2C+GPIO null pointer dereference

Source: https://junglewise.ai/threats/cve-2026-79976-the-mctp-over-i2c-gpio-target-binding-in-subsys-pmci-mctp-mctp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-79976 · Severity: high · CVSS 7.1 · Published 2026-10-21

MCTP (Management Component Transport Protocol) is used for communication between system components like the BMC and firmware. A flaw in the Linux kernel's I2C GPIO target binding allows any device on the shared management bus to trigger a null pointer dereference in the I2C interrupt handler, causing a denial of service through device reset or halt. This affects systems with experimental MCTP support enabled.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-79976 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79976 being exploited in the wild.

**How severe is CVE-2026-79976?** High severity, with a CVSS score of 7.1, published 21 October 2026.

**Which products and versions are affected?** Linux Kernel versions with CONFIG_MCTP_I2C_GPIO_TARGET enabled.

**Is there a fix for CVE-2026-79976?** Yes: fixed in <UNKNOWN>. Until then: Disable CONFIG_MCTP_I2C_GPIO_TARGET in the kernel configuration unless MCTP over I2C GPIO management bus communication is required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79976 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-79976?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in <UNKNOWN>

Disable CONFIG_MCTP_I2C_GPIO_TARGET in the kernel configuration unless MCTP over I2C GPIO management bus communication is required.

## Technical details

The MCTP-over-I2C+GPIO target binding fails to clear register selection state (b->reg_addr) and the data-phase flag (b->rxtx) when the I2C controller issues a STOP condition, leaving stale references to freed packet buffers. An attacker with controller access to the shared I2C bus can issue two ordinary transactions to trigger a null pointer dereference in mctp_i2c_gpio_target_stop() during the interrupt handler, or on transmit cause double-signaling of tx_complete and packet loss. The vulnerability requires CONFIG_MCTP and CONFIG_MCTP_I2C_GPIO_TARGET enabled.

## Affected products

- Linux kernel versions with CONFIG_MCTP_I2C_GPIO_TARGET enabled

## Timeline

- 2026-10-21: disclosed

## Related threats

- [Linux kernel xen-netback double unmap memory corruption](https://junglewise.ai/threats/cve-2026-99287-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel PMC uninitialized clock rate in 32-bit Tegra](https://junglewise.ai/threats/cve-2026-99259-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel x86 Hyper-V memory access violation](https://junglewise.ai/threats/cve-2026-99258-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel io_uring signal loss in worker exit](https://junglewise.ai/threats/cve-2026-99228-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel mv643xx_eth NULL pointer dereference in PHY probe](https://junglewise.ai/threats/cve-2026-99197-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)