CVE-2025-21903: mctp i3c: handle NULL header address
In the Linux kernel, the following vulnerability has been resolved:
mctp i3c: handle NULL header address
daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped.
saddr will usually be set by MCTP core, but check for NULL in case a packet is transmitted by a different protocol.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the MCTP I3C handling path, drop the transmitted packet when the destination address (daddr) is NULL because no neighbour table entry is present, and check for a NULL source address (saddr) before transmission.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel's MCTP over I3C transmit path are exposed when a packet is sent without a required destination or source header address. The issue is local-only and requires low-privileged access.
What conditions are needed to trigger the failure?
A transmit attempt must encounter a missing neighbour-table entry, causing the destination address to be NULL. A NULL source address can also occur if a packet is transmitted by a protocol other than the MCTP core.
What is the impact of successful exploitation?
The vulnerability can cause a denial of service. The provided vector indicates no confidentiality or integrity impact.
What can be done if an update cannot be applied immediately?
No workaround is provided in the available data. Reduce exposure by preventing untrusted low-privileged local users or processes from accessing the affected MCTP/I3C transmit functionality.