CVE-2026-68124
mctp: serial: handle zero-length frames to prevent rx buffer overflow
Description
In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctp_serial_push_header() case 2 and validates it upper-bound-only: if (c > MCTP_SERIAL_FRAME_MTU) { dev->rxstate = STATE_ERR; } else { dev->rxlen = c; dev->rxpos = 0; dev->rxstate = STATE_DATA; ... } A length of zero passes this check, so rxlen is set to 0 and the state machine advances to STATE_DATA. In mctp_serial_push() STATE_DATA, the incoming byte is stored and rxpos incremented before the terminator is dev->rxbuf[dev->rxpos] = c; dev->rxpos++; dev->rxstate = STATE_DATA; if (dev->rxpos == dev->rxlen) { dev->rxpos = 0; dev->rxstate = STATE_TRAILER; } With rxlen == 0 the "rxpos == rxlen" terminator can never fire (rxpos is already 1 on the first data byte), so subsequent bytes are written past the end of the fixed 74-byte rxbuf, which is the last member of the netdev private area. Every following data byte is an attacker-controlled 1-byte out-of-bounds heap write, and the overflow continues until a frame (0x7e) or escape byte resets the parser -- effectively unbounded. Reaching this requires CAP_NET_ADMIN to attach the N_MCTP line discipline and bring the resulting mctpserialN netdev up, after which the bytes arrive via the tty receive path. Route a zero-length frame straight to STATE_TRAILER instead of STATE_DATA. The trailer/framing bytes are still consumed, and the frame resolves to a zero-length skb that the MCTP core rejects; the parser never enters STATE_DATA with rxlen == 0, so the out-of-bounds write can no longer occur. KASAN, on a frame of 0x7e 0x01 0x00 followed by data bytes (before this change): UBSAN: array-index-out-of-bounds in drivers/net/mctp/mctp-serial.c:370 index 74 is out of range for type 'u8 [74]' BUG: KASAN: slab-out-of-bounds in mctp_serial_tty_receive_buf Write of size 1 at addr ... by task kworker/u16:0 mctp_serial_tty_receive_buf tty_ldisc_receive_buf flush_to_ldisc Allocated by task 152: alloc_netdev_mqs mctp_serial_open v2: route zero-length frames to STATE_TRAILER instead of STATE_ERR so the trailer/framing bytes are still consumed (Jeremy Kerr). Found by 0sec automated security-research tooling (https://0sec.ai).
INFO
Published Date :
Aug. 10, 2026, 1:19 p.m.
Last Modified :
Aug. 17, 2026, 5:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the latest version.
- Apply the specific patch for the mctp serial vulnerability.
- Route zero-length frames to STATE_TRAILER.
- Ensure rxlen checks prevent out-of-bounds access.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-68124.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-68124 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-68124
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-68124 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-68124 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': '36dc6d6964a3b90411cc7944cd9b8b6f67b9807b', 'versionType': 'git'}, {'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': '68819427bc07eca7963a9e8be19e5272cc29186c', 'versionType': 'git'}, {'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': 'f80ba170d7b3a44e3d244a2c8e06031d61bf3b23', 'versionType': 'git'}, {'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': '06a6b606129c8a25cd457760f5370f3ff01fe05d', 'versionType': 'git'}, {'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': '793b9b729f1e8de57be8c8daf1a9838be96cabed', 'versionType': 'git'}], 'programFiles': ['drivers/net/mctp/mctp-serial.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc5', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/mctp/mctp-serial.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': '36dc6d6964a3b90411cc7944cd9b8b6f67b9807b', 'versionType': 'git'}, {'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': '68819427bc07eca7963a9e8be19e5272cc29186c', 'versionType': 'git'}, {'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': 'f80ba170d7b3a44e3d244a2c8e06031d61bf3b23', 'versionType': 'git'}, {'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': '06a6b606129c8a25cd457760f5370f3ff01fe05d', 'versionType': 'git'}, {'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': '793b9b729f1e8de57be8c8daf1a9838be96cabed', 'versionType': 'git'}], 'programFiles': ['drivers/net/mctp/mctp-serial.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/mctp/mctp-serial.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 13, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 10, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': '36dc6d6964a3b90411cc7944cd9b8b6f67b9807b', 'versionType': 'git'}, {'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': '68819427bc07eca7963a9e8be19e5272cc29186c', 'versionType': 'git'}, {'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': 'f80ba170d7b3a44e3d244a2c8e06031d61bf3b23', 'versionType': 'git'}, {'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': '06a6b606129c8a25cd457760f5370f3ff01fe05d', 'versionType': 'git'}, {'status': 'affected', 'version': 'a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd', 'lessThan': '793b9b729f1e8de57be8c8daf1a9838be96cabed', 'versionType': 'git'}], 'programFiles': ['drivers/net/mctp/mctp-serial.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc5', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/mctp/mctp-serial.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctp_serial_push_header() case 2 and validates it upper-bound-only: if (c > MCTP_SERIAL_FRAME_MTU) { dev->rxstate = STATE_ERR; } else { dev->rxlen = c; dev->rxpos = 0; dev->rxstate = STATE_DATA; ... } A length of zero passes this check, so rxlen is set to 0 and the state machine advances to STATE_DATA. In mctp_serial_push() STATE_DATA, the incoming byte is stored and rxpos incremented before the terminator is dev->rxbuf[dev->rxpos] = c; dev->rxpos++; dev->rxstate = STATE_DATA; if (dev->rxpos == dev->rxlen) { dev->rxpos = 0; dev->rxstate = STATE_TRAILER; } With rxlen == 0 the "rxpos == rxlen" terminator can never fire (rxpos is already 1 on the first data byte), so subsequent bytes are written past the end of the fixed 74-byte rxbuf, which is the last member of the netdev private area. Every following data byte is an attacker-controlled 1-byte out-of-bounds heap write, and the overflow continues until a frame (0x7e) or escape byte resets the parser -- effectively unbounded. Reaching this requires CAP_NET_ADMIN to attach the N_MCTP line discipline and bring the resulting mctpserialN netdev up, after which the bytes arrive via the tty receive path. Route a zero-length frame straight to STATE_TRAILER instead of STATE_DATA. The trailer/framing bytes are still consumed, and the frame resolves to a zero-length skb that the MCTP core rejects; the parser never enters STATE_DATA with rxlen == 0, so the out-of-bounds write can no longer occur. KASAN, on a frame of 0x7e 0x01 0x00 followed by data bytes (before this change): UBSAN: array-index-out-of-bounds in drivers/net/mctp/mctp-serial.c:370 index 74 is out of range for type 'u8 [74]' BUG: KASAN: slab-out-of-bounds in mctp_serial_tty_receive_buf Write of size 1 at addr ... by task kworker/u16:0 mctp_serial_tty_receive_buf tty_ldisc_receive_buf flush_to_ldisc Allocated by task 152: alloc_netdev_mqs mctp_serial_open v2: route zero-length frames to STATE_TRAILER instead of STATE_ERR so the trailer/framing bytes are still consumed (Jeremy Kerr). Found by 0sec automated security-research tooling (https://0sec.ai). Added Reference https://git.kernel.org/stable/c/06a6b606129c8a25cd457760f5370f3ff01fe05d Added Reference https://git.kernel.org/stable/c/36dc6d6964a3b90411cc7944cd9b8b6f67b9807b Added Reference https://git.kernel.org/stable/c/68819427bc07eca7963a9e8be19e5272cc29186c Added Reference https://git.kernel.org/stable/c/793b9b729f1e8de57be8c8daf1a9838be96cabed Added Reference https://git.kernel.org/stable/c/f80ba170d7b3a44e3d244a2c8e06031d61bf3b23