Is CVE-2026-85032 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85032 being exploited in the wild.

How severe is CVE-2026-85032?

Medium severity, with a CVSS score of 4.8, published 3 November 2026.

Which products and versions are affected?

Zephyr Project Zephyr OS versions with CONFIG_MCTP_USB enabled.

Is there a fix for CVE-2026-85032?

Yes: fixed in Zephyr commit with k_work_cancel_sync() replacement (specific version not provided in advisory). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85032 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-85032?

Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85032: Zephyr MCTP over USB use-after-free in packet buffer handling

CVE-2026-85032 · Severity: medium · CVSS 4.8 · Published 2026-11-03

Zephyr's MCTP (Management Component Transport Protocol) over USB implementation has a race condition that allows an attacker with USB host access to trigger a use-after-free vulnerability. By repeatedly sending partial MCTP frames and forcing USB configuration changes or bus resets, an attacker can corrupt memory or cause a denial of service without needing credentials. This could lead to system instability or data corruption on devices using the MCTP subsystem.

Technologies: Zephyr Project Zephyr OS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-85032 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85032 being exploited in the wild.
How severe is CVE-2026-85032?: Medium severity, with a CVSS score of 4.8, published 3 November 2026.
Which products and versions are affected?: Zephyr Project Zephyr OS versions with CONFIG_MCTP_USB enabled.
Is there a fix for CVE-2026-85032?: Yes: fixed in Zephyr commit with k_work_cancel_sync() replacement (specific version not provided in advisory). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85032 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-85032?: Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Zephyr commit with k_work_cancel_sync() replacement (specific version not provided in advisory)

Technical details

The vulnerability exists in subsys/pmci/mctp/mctp_usb.c where RX handling is split across two threads: the system workqueue running mctp_usb_class_out_work() parses incoming data into a packet buffer (usb->rx_pkt), while a USB device stack thread can invoke mctp_usb_class_disable(). The disable handler used k_work_cancel() which does not wait for in-progress handlers, then immediately freed the packet buffer via mctp_pktbuf_free(). On SMP systems or with preemptible workqueues, this creates a window where the worker can write to freed memory; on cooperative-only systems, the worker may resume after the free and dereference a NULLed pointer. The fix replaces k_work_cancel() with k_work_cancel_sync() to ensure the worker completes before memory is freed.

Affected products

Zephyr Project Zephyr OS versions with CONFIG_MCTP_USB enabled

Timeline

2026-11-03: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.