CVE-2026-98018net: mctp: i3c: serialize probe with bus removal
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctp_i3c_probe() drops busdevs_lock after finding the matching bus. A concurrent I3C_NOTIFY_BUS_REMOVE can then unregister and free the bus netdev before probe passes its private data to mctp_i3c_add_device(). The latter consequently adds a list node through a freed mbus pointer. Keep busdevs_lock held until the device has been added. This also satisfies the __must_hold annotation on mctp_i3c_add_device().
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 before e6541b2747682fdb2c6ded4a7cf7c39c4067a35c; from c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 before 765c5e357e67916a7aac8ead4ac2fa7d2bffe000; from c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 before 906d8dbafabfa81a30e3ade420cb9912f223a5e1; from c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 before 2b4707a149a55e8fa75c9ef32b359d60f470a566 | CNA record |
References
- https://git.kernel.org/stable/c/e6541b2747682fdb2c6ded4a7cf7c39c4067a35c
- https://git.kernel.org/stable/c/765c5e357e67916a7aac8ead4ac2fa7d2bffe000
- https://git.kernel.org/stable/c/906d8dbafabfa81a30e3ade420cb9912f223a5e1
- https://git.kernel.org/stable/c/2b4707a149a55e8fa75c9ef32b359d60f470a566
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.