CVE-2026-68314

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68314", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.382Z", "datePublished": "2026-08-10T12:02:49.124Z", "dateUpdated": "2026-08-17T05:03:10.989Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:03:10.989Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mctp i3c: clean up notifier and buses if driver register fails\n\nmctp_i3c_mod_init() registers the I3C bus notifier and then walks the\nexisting buses with i3c_for_each_bus_locked(mctp_i3c_bus_add_new, NULL)\nbefore registering the I3C device driver. If i3c_driver_register()\nfails, the function returns the error directly, leaving the notifier\nregistered and every mctp_i3c_bus object created for the existing buses\nallocated. The notifier is left pointing into the module that failed to\nload and the bus list is leaked.\n\nMirror the module exit path on this failure: unregister the notifier and\ntear down the buses that were added before returning the error.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The stale notifier and leftover mctpi3cN netdevs are reached from the local system \u2014 an AF_MCTP socket transmit or a local I3C bus hotplug event \u2014 not from any remote or adjacent network peer.\nAC:L - Once module init has failed, the leftover state is deterministic and any local user can drive traffic into the freed module's netdev ops or wait for a bus event with no additional conditions to win.\nPR:L - After the failed load leaves the interfaces registered, an ordinary unprivileged user can open an AF_MCTP socket and send on the stale mctpi3cN interface, dereferencing function pointers in freed module memory without any capability.\nUI:N - No victim action is needed; the leftover netdevs and notifier are globally visible and can be exercised directly by the attacker or by ordinary I3C bus events.\nS:U - The stale pointers and leaked objects are all kernel-side resources within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Execution against freed module text/data is a use-after-free of a region that can be reclaimed and shaped by the attacker, permitting disclosure of arbitrary kernel memory contents through the reused allocation.\nI:H - Calling through notifier_call and netdev_ops pointers residing in freed module memory yields control-flow hijack once that memory is reallocated, giving an arbitrary write / code execution primitive.\nA:H - Even without successful reclamation, invoking the stale notifier or the leftover netdev's ops jumps into unmapped or reused memory and reliably oopses/panics the kernel; the leaked netdevs and kthread are also never freed."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/mctp/mctp-i3c.c"], "versions": [{"version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5", "lessThan": "49d15cfab247c0f60ce1800bdcd66850beea7b3a", "status": "affected", "versionType": "git"}, {"version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5", "lessThan": "a8bd8c109da5a87f0c5db0c23cf550d039fde77c", "status": "affected", "versionType": "git"}, {"version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5", "lessThan": "a40e83a34eaa2be64372286040696f04eabcd09f", "status": "affected", "versionType": "git"}, {"version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5", "lessThan": "03d1057305ef17ac3f5936ac1580bc9a1a826e14", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/mctp/mctp-i3c.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/49d15cfab247c0f60ce1800bdcd66850beea7b3a"}, {"url": "https://git.kernel.org/stable/c/a8bd8c109da5a87f0c5db0c23cf550d039fde77c"}, {"url": "https://git.kernel.org/stable/c/a40e83a34eaa2be64372286040696f04eabcd09f"}, {"url": "https://git.kernel.org/stable/c/03d1057305ef17ac3f5936ac1580bc9a1a826e14"}], "title": "net: mctp i3c: clean up notifier and buses if driver register fails", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/mctp/mctp-i3c.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "49d15cfab247c0f60ce1800bdcd66850beea7b3a", "status": "affected", "version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5", "versionType": "git"}, {"lessThan": "a8bd8c109da5a87f0c5db0c23cf550d039fde77c", "status": "affected", "version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5", "versionType": "git"}, {"lessThan": "a40e83a34eaa2be64372286040696f04eabcd09f", "status": "affected", "version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5", "versionType": "git"}, {"lessThan": "03d1057305ef17ac3f5936ac1580bc9a1a826e14", "status": "affected", "version": "c8755b29b58ec65be17bcb8c40763d2dcb1f1db5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/mctp/mctp-i3c.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mctp i3c: clean up notifier and buses if driver register fails\n\nmctp_i3c_mod_init() registers the I3C bus notifier and then walks the\nexisting buses with i3c_for_each_bus_locked(mctp_i3c_bus_add_new, NULL)\nbefore registering the I3C device driver. If i3c_driver_register()\nfails, the function returns the error directly, leaving the notifier\nregistered and every mctp_i3c_bus object created for the existing buses\nallocated. The notifier is left pointing into the module that failed to\nload and the bus list is leaked.\n\nMirror the module exit path on this failure: unregister the notifier and\ntear down the buses that were added before returning the error.\n\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code."}], "id": "CVE-2026-68314", "lastModified": "2026-08-17T05:18:34.267", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-10T13:20:21.307", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/03d1057305ef17ac3f5936ac1580bc9a1a826e14"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/49d15cfab247c0f60ce1800bdcd66850beea7b3a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a40e83a34eaa2be64372286040696f04eabcd09f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a8bd8c109da5a87f0c5db0c23cf550d039fde77c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: mctp i3c: clean up notifier and buses if driver register fails", "id": "2513465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513465"}, "csaw": false, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: mctp i3c: clean up notifier and buses if driver register fails\nmctp_i3c_mod_init() registers the I3C bus notifier and then walks the\nexisting buses with i3c_for_each_bus_locked(mctp_i3c_bus_add_new, NULL)\nbefore registering the I3C device driver. If i3c_driver_register()\nfails, the function returns the error directly, leaving the notifier\nregistered and every mctp_i3c_bus object created for the existing buses\nallocated. The notifier is left pointing into the module that failed to\nload and the bus list is leaked.\nMirror the module exit path on this failure: unregister the notifier and\ntear down the buses that were added before returning the error.\nThis issue was identified during our ongoing static-analysis research while\nreviewing kernel code.", "A flaw was found in the Linux kernel's MCTP I3C network module. When the i3c_driver_register() function fails during module initialization, the system does not properly unregister notifiers and deallocate bus objects. This oversight leads to a memory leak, which could be exploited by a local attacker to cause a Denial of Service (DoS) due to resource exhaustion."], "name": "CVE-2026-68314", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68314\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68314\nhttps://lore.kernel.org/linux-cve-announce/2026081032-CVE-2026-68314-39d2@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c8755b29b58ec65be17bcb8c40763d2dcb1f1db5,49d15cfab247c0f60ce1800bdcd66850beea7b3a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c8755b29b58ec65be17bcb8c40763d2dcb1f1db5,a8bd8c109da5a87f0c5db0c23cf550d039fde77c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c8755b29b58ec65be17bcb8c40763d2dcb1f1db5,a40e83a34eaa2be64372286040696f04eabcd09f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c8755b29b58ec65be17bcb8c40763d2dcb1f1db5,03d1057305ef17ac3f5936ac1580bc9a1a826e14)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T15:15:04.691965+00:00", "updated": "2026-08-14T00:15:04.811335+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}