CVE-2026-68124

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mctp: serial: handle zero-length frames to prevent rx buffer overflow<br /> <br /> The MCTP serial receive state machine reads a frame length byte in<br /> mctp_serial_push_header() case 2 and validates it upper-bound-only:<br /> <br /> if (c &gt; MCTP_SERIAL_FRAME_MTU) {<br /> dev-&gt;rxstate = STATE_ERR;<br /> } else {<br /> dev-&gt;rxlen = c;<br /> dev-&gt;rxpos = 0;<br /> dev-&gt;rxstate = STATE_DATA;<br /> ...<br /> }<br /> <br /> A length of zero passes this check, so rxlen is set to 0 and the state<br /> machine advances to STATE_DATA. In mctp_serial_push() STATE_DATA, the<br /> incoming byte is stored and rxpos incremented before the terminator is<br /> <br /> dev-&gt;rxbuf[dev-&gt;rxpos] = c;<br /> dev-&gt;rxpos++;<br /> dev-&gt;rxstate = STATE_DATA;<br /> if (dev-&gt;rxpos == dev-&gt;rxlen) {<br /> dev-&gt;rxpos = 0;<br /> dev-&gt;rxstate = STATE_TRAILER;<br /> }<br /> <br /> With rxlen == 0 the "rxpos == rxlen" terminator can never fire (rxpos is<br /> already 1 on the first data byte), so subsequent bytes are written past<br /> the end of the fixed 74-byte rxbuf, which is the last member of the<br /> netdev private area. Every following data byte is an attacker-controlled<br /> 1-byte out-of-bounds heap write, and the overflow continues until a<br /> frame (0x7e) or escape byte resets the parser -- effectively unbounded.<br /> <br /> Reaching this requires CAP_NET_ADMIN to attach the N_MCTP line<br /> discipline and bring the resulting mctpserialN netdev up, after which<br /> the bytes arrive via the tty receive path.<br /> <br /> Route a zero-length frame straight to STATE_TRAILER instead of<br /> STATE_DATA. The trailer/framing bytes are still consumed, and the frame<br /> resolves to a zero-length skb that the MCTP core rejects; the parser<br /> never enters STATE_DATA with rxlen == 0, so the out-of-bounds write can<br /> no longer occur.<br /> <br /> KASAN, on a frame of 0x7e 0x01 0x00 followed by data bytes (before this<br /> change):<br /> <br /> UBSAN: array-index-out-of-bounds in drivers/net/mctp/mctp-serial.c:370<br /> index 74 is out of range for type &amp;#39;u8 [74]&amp;#39;<br /> BUG: KASAN: slab-out-of-bounds in mctp_serial_tty_receive_buf<br /> Write of size 1 at addr ... by task kworker/u16:0<br /> mctp_serial_tty_receive_buf<br /> tty_ldisc_receive_buf<br /> flush_to_ldisc<br /> Allocated by task 152:<br /> alloc_netdev_mqs<br /> mctp_serial_open<br /> <br /> v2: route zero-length frames to STATE_TRAILER instead of STATE_ERR so<br /> the trailer/framing bytes are still consumed (Jeremy Kerr).<br /> <br /> Found by 0sec automated security-research tooling (https://0sec.ai).