CVE-2026-68124

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mctp: serial: handle zero-length frames to prevent rx buffer overflow

The MCTP serial receive state machine reads a frame length byte in

mctp_serial_push_header() case 2 and validates it upper-bound-only:

if (c > MCTP_SERIAL_FRAME_MTU) {

dev->rxstate = STATE_ERR;

} else {

dev->rxlen = c;

dev->rxpos = 0;

dev->rxstate = STATE_DATA;

...

}

A length of zero passes this check, so rxlen is set to 0 and the state

machine advances to STATE_DATA. In mctp_serial_push() STATE_DATA, the

incoming byte is stored and rxpos incremented before the terminator is

dev->rxbuf[dev->rxpos] = c;

dev->rxpos++;

dev->rxstate = STATE_DATA;

if (dev->rxpos == dev->rxlen) {

dev->rxpos = 0;

dev->rxstate = STATE_TRAILER;

}

With rxlen == 0 the "rxpos == rxlen" terminator can never fire (rxpos is

already 1 on the first data byte), so subsequent bytes are written past

the end of the fixed 74-byte rxbuf, which is the last member

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References