CVE-2026-68314

What it actually does

Failure path in mctp_i3c_mod_init leaves a registered I3C bus notifier pointing into the module and leaks mctp_i3c_bus objects when i3c_driver_register fails, creating a dangling notifier and unbounded memory leak.

Why it matters to the business

Linux systems using MCTP over I3C may experience gradual memory exhaustion or kernel instability after a driver load failure, increasing operational risk on embedded or automotive devices where this subsystem is present.

How an attack unfolds

An attacker with local access triggers conditions that cause i3c_driver_register to fail after the notifier and bus walk have completed; the resulting dangling notifier can later be invoked, leading to arbitrary code execution or memory corruption.

How to fix it

Apply the upstream fix that mirrors the module-exit cleanup on the registration error path; rebuild and deploy the corrected kernel. Monitor for backports in distribution kernels.

How to confirm the fix worked

Confirm the corrected error-handling path exists in net/mctp/i3c.c and that module unload or forced registration failure no longer leaks notifier or bus objects; review dmesg and slabinfo for leaks during driver load tests.

Typical attack path

1. Obtain local user privileges on a vulnerable Linux kernel
2. Trigger or force an I3C driver registration failure after notifier setup
3. Invoke the stale notifier callback to dereference freed or module memory
4. Achieve memory corruption or control-flow hijack for privilege escalation

How to detect it

Review kernel logs for I3C bus notifier registration messages followed by driver load failures; inspect for unexpected growth in mctp or i3c slab objects after module load attempts.

What your security team should do

• Prioritize kernel updates on systems exposing I3C or MCTP interfaces
• Restrict local user access on affected devices until patched
• Add kernel module load failure and notifier registration events to monitoring