CVE-2026-79976
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The MCTP-over-I2C+GPIO target binding (mctp_i2c_gpio_target.c) fails to clear the selected register (b->reg_addr) and data-phase flag (b->rxtx) on I2C STOP. A bus controller can use two ordinary transactions to make mctp_bus_rx() run with a NULL buffer or to dereference b->tx_pkt->end after it was cleared, triggering an exception in the I2C target interrupt handler and a device reset or halt.
Risk Assessment
Any device able to act as controller on the shared management bus (e.g. compromised firmware on a peer MCTP endpoint or the BMC) can cause a denial of service. On parts where address 0 is readable, impact degrades to a malformed packet buffer reaching the MCTP stack and lost transmit packets, with no confidentiality or integrity boundary crossed.
Recommendation
Update the kernel/system to a version containing the fix that resets b->reg_addr to MCTP_I2C_GPIO_INVALID_ADDR and clears b->rxtx on every STOP. If the feature is not needed, disable CONFIG_MCTP_I2C_GPIO_TARGET (only builds with the experimental CONFIG_MCTP are affected).
Related vulnerabilities
- CVE-2026-121933Critical
A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the Setup Wizard component. Manipulating the wizard_router_pwd argument can lead to missing authentication. The attack may be launched remotely, and the exploit has been published and may be used.
- CVE-2026-113373Critical
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account and then receives a new session with the roles of that account.
- CVE-2026-122120Critical
In Yealink Plug-in Softwares before 2.35.219.0, an unauthorized file write vulnerability exists under specific scenarios. It may be exploited by attackers to achieve remote code execution.
- CVE-2026-121932Critical
In Linksys E5350 1.0.00.037, the system function in /wizard/apply.cgi mishandles the ping_ip/traceroute_ip argument, resulting in OS command injection. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-121931Critical
In Linksys WRT54GL 4.30.18, the system function in apply.cgi (Traceroute Diagnostic component) mishandles the traceroute_ip argument, enabling OS command injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-121930Critical
In Linksys WRT54GL 4.30.18, the system function in apply.cgi (Ping Diagnostic component) mishandles the ping_ip argument, causing OS command injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-113780Critical
In ESP-IDF (Espressif IoT Development Framework) from 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary.
- CVE-2026-107846Critical
In bitcoinjs-lib (JavaScript Bitcoin library for Node.js and browsers) from 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. Validation paths can accept a recomputed root without checking for mutation, allowing a peer to append duplicate transactions while retaining the original Merkle root, block header, and proof of work.
- CVE-2026-121953Critical
FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.
- CVE-2026-121952Critical
FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a crash.
Original NVD description (English source)
The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register (b->reg_addr) and the data-phase flag (b->rxtx) were never cleared when the controller issued an I2C STOP, so after a completed transfer the target still had a data register selected while the packet buffer that register refers to had already been consumed and set to NULL by mctp_i2c_gpio_target_stop(). A controller on the bus can re-enter the same branch of mctp_i2c_gpio_target_stop() with a NULL buffer using two ordinary transactions and no authentication: first a normal packet write to MCTP_I2C_GPIO_RX_MSG_ADDR followed by STOP (which delivers and frees b->rx_pkt), then a bare read transaction followed by STOP. The failing read_requested() call leaves the stale state untouched and the I2C driver still delivers the STOP callback, which then calls mctp_bus_rx() with a NULL packet. The symmetric case exists on the transmit side, where the stale MCTP_I2C_GPIO_TX_MSG_ADDR selection dereferences b->tx_pkt->end after b->tx_pkt has been cleared and additionally signals b->tx_complete a second time, causing the next outbound packet to be dropped. The dereference happens in the I2C target interrupt handler, so on any target that traps accesses to address 0 the result is a fatal exception and a device reset or halt — a denial of service inflicted by any device able to act as controller on the shared management bus (for example compromised firmware on a peer MCTP endpoint or on the BMC). On parts where address 0 is readable, the impact degrades to a malformed packet buffer being handed to the MCTP stack and lost transmit packets. No attacker-controlled value is written and no confidentiality or integrity boundary is crossed. The fix resets b->reg_addr to MCTP_I2C_GPIO_INVALID_ADDR and clears b->rxtx at every STOP, so a new register must be selected before any data phase can run again. Only builds that opt into the experimental CONFIG_MCTP subsystem with CONFIG_MCTP_I2C_GPIO_TARGET=y are affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS