Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-79976— NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 中，MCTP-over-I2C+GPIO 目标绑定（target binding）模拟了一个小型伪寄存器文件。其工作流程为：总线控制器首先写入寄存器编号，随后写入或读取有效载荷字节。然而，当控制器发出 I2C STOP 信号时，选中的寄存器地址（ ）和数据相位标志（ ）从未被清除。因此，在一次传输完成后，目标端仍保留着某个数据寄存器的选中状态，而该寄存器所指向的数据包缓冲区却已被 函数消耗并置为 NULL。 总线上的任意控制器可通过两次普通事务（无需任何认证）重新触发 中的同一分支，且此时缓冲区为 NULL：首

CVSS 7.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
zephyrproject zephyr 4.3.0≤ 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-79976

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller
Source: CVE Program / CVE List V5
Vulnerability Description
The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register (b->reg_addr) and the data-phase flag (b->rxtx) were never cleared when the controller issued an I2C STOP, so after a completed transfer the target still had a data register selected while the packet buffer that register refers to had already been consumed and set to NULL by mctp_i2c_gpio_target_stop(). A controller on the bus can re-enter the same branch of mctp_i2c_gpio_target_stop() with a NULL buffer using two ordinary transactions and no authentication: first a normal packet write to MCTP_I2C_GPIO_RX_MSG_ADDR followed by STOP (which delivers and frees b->rx_pkt), then a bare read transaction followed by STOP. The failing read_requested() call leaves the stale state untouched and the I2C driver still delivers the STOP callback, which then calls mctp_bus_rx() with a NULL packet. The symmetric case exists on the transmit side, where the stale MCTP_I2C_GPIO_TX_MSG_ADDR selection dereferences b->tx_pkt->end after b->tx_pkt has been cleared and additionally signals b->tx_complete a second time, causing the next outbound packet to be dropped. The dereference happens in the I2C target interrupt handler, so on any target that traps accesses to address 0 the result is a fatal exception and a device reset or halt — a denial of service inflicted by any device able to act as controller on the shared management bus (for example compromised firmware on a peer MCTP endpoint or on the BMC). On parts where address 0 is readable, the impact degrades to a malformed packet buffer being handed to the MCTP stack and lost transmit packets. No attacker-controlled value is written and no confidentiality or integrity boundary is crossed. The fix resets b->reg_addr to MCTP_I2C_GPIO_INVALID_ADDR and clears b->rxtx at every STOP, so a new register must be selected before any data phase can run again. Only builds that opt into the experimental CONFIG_MCTP subsystem with CONFIG_MCTP_I2C_GPIO_TARGET=y are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 4.3.0 ~ 4.4.2 -

II. Public POCs for CVE-2026-79976

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-79976

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-79976 (1)

Vendor Advisories for CVE-2026-79976 (1)

Same Patch Batch · zephyrproject · 2026-10-21 · 8 CVEs total

CVE-2026-19676 7.8 HIGH PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing a
CVE-2026-78118 7.0 HIGH Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration
CVE-2026-78119 6.3 MEDIUM Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an un
CVE-2026-19947 5.3 MEDIUM Missing kernel object permission check in devmux syscalls allows unprivileged user threads
CVE-2026-78116 5.2 MEDIUM Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation e
CVE-2026-78117 4.2 MEDIUM Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver c
CVE-2026-18748 3.5 LOW Out-of-bounds read in Bluetooth Classic A2DP codec information element handling

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-476

V. Comments for CVE-2026-79976

No comments yet

Leave a comment