CVE-2026-98018: net: mctp: i3c: serialize probe with bus removal
In the Linux kernel, the following vulnerability has been resolved:
net: mctp: i3c: serialize probe with bus removal
mctpi3cprobe() drops busdevslock after finding the matching bus. A concurrent I3CNOTIFYBUSREMOVE can then unregister and free the bus netdev before probe passes its private data to mctpi3cadddevice(). The latter consequently adds a list node through a freed mbus pointer.
Keep busdevslock held until the device has been added. This also satisfies the musthold annotation on mctpi3cadddevice().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Modify mctp_i3c_probe() to keep busdevs_lock held after finding the matching bus until the device has been added via mctp_i3c_add_device(), preventing concurrent I3C_NOTIFY_BUS_REMOVE from freeing the bus netdev first.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The race requires an MCTP-over-I3C device probe to overlap with an I3C bus-removal notification. The removal can unregister and free the bus network device after probe finds the bus but before it adds the device.
What is the practical impact if the race occurs?
The probe path can pass private data associated with a freed bus netdev to mctp_i3c_add_device(). That function may then add a list node through a freed mbus pointer, resulting in a use-after-free condition.
Which systems are exposed?
Systems using the Linux kernel's MCTP I3C support are relevant when I3C device probing and bus removal can occur concurrently. The provided information does not identify affected kernel versions or indicate whether this configuration is enabled by default.
What change resolves the race?
The fix keeps busdevs_lock held until the device has been added. This prevents bus removal from freeing the bus netdev during the probe sequence and ensures mctp_i3c_add_device() is called while its required lock is held.