CVE-2026-68124 (GCVE-0-2026-68124)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:58 – Updated: 2026-08-19 16:29
VLAI
Title
mctp: serial: handle zero-length frames to prevent rx buffer overflow
Summary
In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctp_serial_push_header() case 2 and validates it upper-bound-only: if (c > MCTP_SERIAL_FRAME_MTU) { dev->rxstate = STATE_ERR; } else { dev->rxlen = c; dev->rxpos = 0; dev->rxstate = STATE_DATA; ... } A length of zero passes this check, so rxlen is set to 0 and the state machine advances to STATE_DATA. In mctp_serial_push() STATE_DATA, the incoming byte is stored and rxpos incremented before the terminator is dev->rxbuf[dev->rxpos] = c; dev->rxpos++; dev->rxstate = STATE_DATA; if (dev->rxpos == dev->rxlen) { dev->rxpos = 0; dev->rxstate = STATE_TRAILER; } With rxlen == 0 the "rxpos == rxlen" terminator can never fire (rxpos is already 1 on the first data byte), so subsequent bytes are written past the end of the fixed 74-byte rxbuf, which is the last member of the netdev private area. Every following data byte is an attacker-controlled 1-byte out-of-bounds heap write, and the overflow continues until a frame (0x7e) or escape byte resets the parser -- effectively unbounded. Reaching this requires CAP_NET_ADMIN to attach the N_MCTP line discipline and bring the resulting mctpserialN netdev up, after which the bytes arrive via the tty receive path. Route a zero-length frame straight to STATE_TRAILER instead of STATE_DATA. The trailer/framing bytes are still consumed, and the frame resolves to a zero-length skb that the MCTP core rejects; the parser never enters STATE_DATA with rxlen == 0, so the out-of-bounds write can no longer occur. KASAN, on a frame of 0x7e 0x01 0x00 followed by data bytes (before this change): UBSAN: array-index-out-of-bounds in drivers/net/mctp/mctp-serial.c:370 index 74 is out of range for type 'u8 [74]' BUG: KASAN: slab-out-of-bounds in mctp_serial_tty_receive_buf Write of size 1 at addr ... by task kworker/u16:0 mctp_serial_tty_receive_buf tty_ldisc_receive_buf flush_to_ldisc Allocated by task 152: alloc_netdev_mqs mctp_serial_open v2: route zero-length frames to STATE_TRAILER instead of STATE_ERR so the trailer/framing bytes are still consumed (Jeremy Kerr). Found by 0sec automated security-research tooling (https://0sec.ai).
Severity
9.6 (Critical)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd , < 64b96ae7912244d55257aa330d9569ee0a8f8d99 (git)
Affected: a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd , < 36dc6d6964a3b90411cc7944cd9b8b6f67b9807b (git)
Affected: a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd , < 68819427bc07eca7963a9e8be19e5272cc29186c (git)
Affected: a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd , < f80ba170d7b3a44e3d244a2c8e06031d61bf3b23 (git)
Affected: a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd , < 06a6b606129c8a25cd457760f5370f3ff01fe05d (git)
Affected: a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd , < 793b9b729f1e8de57be8c8daf1a9838be96cabed (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/mctp/mctp-serial.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "64b96ae7912244d55257aa330d9569ee0a8f8d99",
              "status": "affected",
              "version": "a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd",
              "versionType": "git"
            },
            {
              "lessThan": "36dc6d6964a3b90411cc7944cd9b8b6f67b9807b",
              "status": "affected",
              "version": "a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd",
              "versionType": "git"
            },
            {
              "lessThan": "68819427bc07eca7963a9e8be19e5272cc29186c",
              "status": "affected",
              "version": "a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd",
              "versionType": "git"
            },
            {
              "lessThan": "f80ba170d7b3a44e3d244a2c8e06031d61bf3b23",
              "status": "affected",
              "version": "a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd",
              "versionType": "git"
            },
            {
              "lessThan": "06a6b606129c8a25cd457760f5370f3ff01fe05d",
              "status": "affected",
              "version": "a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd",
              "versionType": "git"
            },
            {
              "lessThan": "793b9b729f1e8de57be8c8daf1a9838be96cabed",
              "status": "affected",
              "version": "a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/mctp/mctp-serial.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmctp: serial: handle zero-length frames to prevent rx buffer overflow\n\nThe MCTP serial receive state machine reads a frame length byte in\nmctp_serial_push_header() case 2 and validates it upper-bound-only:\n\n\tif (c \u003e MCTP_SERIAL_FRAME_MTU) {\n\t\tdev-\u003erxstate = STATE_ERR;\n\t} else {\n\t\tdev-\u003erxlen = c;\n\t\tdev-\u003erxpos = 0;\n\t\tdev-\u003erxstate = STATE_DATA;\n\t\t...\n\t}\n\nA length of zero passes this check, so rxlen is set to 0 and the state\nmachine advances to STATE_DATA. In mctp_serial_push() STATE_DATA, the\nincoming byte is stored and rxpos incremented before the terminator is\n\n\tdev-\u003erxbuf[dev-\u003erxpos] = c;\n\tdev-\u003erxpos++;\n\tdev-\u003erxstate = STATE_DATA;\n\tif (dev-\u003erxpos == dev-\u003erxlen) {\n\t\tdev-\u003erxpos = 0;\n\t\tdev-\u003erxstate = STATE_TRAILER;\n\t}\n\nWith rxlen == 0 the \"rxpos == rxlen\" terminator can never fire (rxpos is\nalready 1 on the first data byte), so subsequent bytes are written past\nthe end of the fixed 74-byte rxbuf, which is the last member of the\nnetdev private area. Every following data byte is an attacker-controlled\n1-byte out-of-bounds heap write, and the overflow continues until a\nframe (0x7e) or escape byte resets the parser -- effectively unbounded.\n\nReaching this requires CAP_NET_ADMIN to attach the N_MCTP line\ndiscipline and bring the resulting mctpserialN netdev up, after which\nthe bytes arrive via the tty receive path.\n\nRoute a zero-length frame straight to STATE_TRAILER instead of\nSTATE_DATA. The trailer/framing bytes are still consumed, and the frame\nresolves to a zero-length skb that the MCTP core rejects; the parser\nnever enters STATE_DATA with rxlen == 0, so the out-of-bounds write can\nno longer occur.\n\nKASAN, on a frame of 0x7e 0x01 0x00 followed by data bytes (before this\nchange):\n\n  UBSAN: array-index-out-of-bounds in drivers/net/mctp/mctp-serial.c:370\n  index 74 is out of range for type \u0027u8 [74]\u0027\n  BUG: KASAN: slab-out-of-bounds in mctp_serial_tty_receive_buf\n  Write of size 1 at addr ... by task kworker/u16:0\n   mctp_serial_tty_receive_buf\n   tty_ldisc_receive_buf\n   flush_to_ldisc\n  Allocated by task 152:\n   alloc_netdev_mqs\n   mctp_serial_open\n\nv2: route zero-length frames to STATE_TRAILER instead of STATE_ERR so\n    the trailer/framing bytes are still consumed (Jeremy Kerr).\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is triggered in mctp_serial_tty_receive_buf() by crafted DSP0253 serial frames; on BMC/datacenter systems MCTP-over-serial links management controllers on a shared management LAN, letting an adjacent unauthenticated peer inject 0x7e/0x01/0x00 frames without using host syscalls.\nAC:L - Exploitation is deterministic: a zero-length length byte bypasses the upper-bound check, then each following serial byte is a controlled 1-byte heap OOB write until 0x7e/0x7d resets the parser; no races or attacker-uncontrollable memory layout are required.\nPR:N - Triggering the overflow only requires delivering malicious serial bytes to an already-configured, running mctpserial netdev; a remote/adjacent MCTP peer or compromised management controller needs no Linux host credentials, CAP_NET_ADMIN, or root on the victim.\nUI:N - No victim user action is required at exploit time; administrative enablement of MCTP serial is deployment configuration, not end-user interaction under CVSS.\nS:C - Kconfig documents virtio-serial VM interconnect for MCTP serial; a malicious guest sending crafted frames to the host-side mctpserial binding can corrupt host kernel heap memory, crossing the guest/host virtualization security boundary.\nC:H - Each overflow byte is attacker-controlled and the write stream is effectively unbounded past the 74-byte rxbuf (last netdev private field), enabling slab-out-of-bounds corruption that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Sustained attacker-controlled out-of-bounds heap writes can corrupt adjacent kmalloc objects, function pointers, and netdev state, providing a standard path to arbitrary kernel write and privilege-escalating code execution.\nA:H - KASAN/UBSAN report slab-out-of-bounds and array-index-out-of-bounds in mctp_serial_tty_receive_buf via flush_to_ldisc; continued overflow reliably causes kernel oops/panic or hang during tty receive processing."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:29:36.851Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/64b96ae7912244d55257aa330d9569ee0a8f8d99"
        },
        {
          "url": "https://git.kernel.org/stable/c/36dc6d6964a3b90411cc7944cd9b8b6f67b9807b"
        },
        {
          "url": "https://git.kernel.org/stable/c/68819427bc07eca7963a9e8be19e5272cc29186c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f80ba170d7b3a44e3d244a2c8e06031d61bf3b23"
        },
        {
          "url": "https://git.kernel.org/stable/c/06a6b606129c8a25cd457760f5370f3ff01fe05d"
        },
        {
          "url": "https://git.kernel.org/stable/c/793b9b729f1e8de57be8c8daf1a9838be96cabed"
        }
      ],
      "title": "mctp: serial: handle zero-length frames to prevent rx buffer overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68124",
    "datePublished": "2026-08-10T11:58:44.997Z",
    "dateReserved": "2026-07-30T09:28:09.369Z",
    "dateUpdated": "2026-08-19T16:29:36.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68124",
      "date": "2026-08-22",
      "epss": "0.00348",
      "percentile": "0.28038"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68124\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:19:57.550\",\"lastModified\":\"2026-08-19T17:20:29.847\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmctp: serial: handle zero-length frames to prevent rx buffer overflow\\n\\nThe MCTP serial receive state machine reads a frame length byte in\\nmctp_serial_push_header() case 2 and validates it upper-bound-only:\\n\\n\\tif (c \u003e MCTP_SERIAL_FRAME_MTU) {\\n\\t\\tdev-\u003erxstate = STATE_ERR;\\n\\t} else {\\n\\t\\tdev-\u003erxlen = c;\\n\\t\\tdev-\u003erxpos = 0;\\n\\t\\tdev-\u003erxstate = STATE_DATA;\\n\\t\\t...\\n\\t}\\n\\nA length of zero passes this check, so rxlen is set to 0 and the state\\nmachine advances to STATE_DATA. In mctp_serial_push() STATE_DATA, the\\nincoming byte is stored and rxpos incremented before the terminator is\\n\\n\\tdev-\u003erxbuf[dev-\u003erxpos] = c;\\n\\tdev-\u003erxpos++;\\n\\tdev-\u003erxstate = STATE_DATA;\\n\\tif (dev-\u003erxpos == dev-\u003erxlen) {\\n\\t\\tdev-\u003erxpos = 0;\\n\\t\\tdev-\u003erxstate = STATE_TRAILER;\\n\\t}\\n\\nWith rxlen == 0 the \\\"rxpos == rxlen\\\" terminator can never fire (rxpos is\\nalready 1 on the first data byte), so subsequent bytes are written past\\nthe end of the fixed 74-byte rxbuf, which is the last member of the\\nnetdev private area. Every following data byte is an attacker-controlled\\n1-byte out-of-bounds heap write, and the overflow continues until a\\nframe (0x7e) or escape byte resets the parser -- effectively unbounded.\\n\\nReaching this requires CAP_NET_ADMIN to attach the N_MCTP line\\ndiscipline and bring the resulting mctpserialN netdev up, after which\\nthe bytes arrive via the tty receive path.\\n\\nRoute a zero-length frame straight to STATE_TRAILER instead of\\nSTATE_DATA. The trailer/framing bytes are still consumed, and the frame\\nresolves to a zero-length skb that the MCTP core rejects; the parser\\nnever enters STATE_DATA with rxlen == 0, so the out-of-bounds write can\\nno longer occur.\\n\\nKASAN, on a frame of 0x7e 0x01 0x00 followed by data bytes (before this\\nchange):\\n\\n  UBSAN: array-index-out-of-bounds in drivers/net/mctp/mctp-serial.c:370\\n  index 74 is out of range for type \u0027u8 [74]\u0027\\n  BUG: KASAN: slab-out-of-bounds in mctp_serial_tty_receive_buf\\n  Write of size 1 at addr ... by task kworker/u16:0\\n   mctp_serial_tty_receive_buf\\n   tty_ldisc_receive_buf\\n   flush_to_ldisc\\n  Allocated by task 152:\\n   alloc_netdev_mqs\\n   mctp_serial_open\\n\\nv2: route zero-length frames to STATE_TRAILER instead of STATE_ERR so\\n    the trailer/framing bytes are still consumed (Jeremy Kerr).\\n\\nFound by 0sec automated security-research tooling (https://0sec.ai).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/mctp/mctp-serial.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd\",\"lessThan\":\"64b96ae7912244d55257aa330d9569ee0a8f8d99\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd\",\"lessThan\":\"36dc6d6964a3b90411cc7944cd9b8b6f67b9807b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd\",\"lessThan\":\"68819427bc07eca7963a9e8be19e5272cc29186c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd\",\"lessThan\":\"f80ba170d7b3a44e3d244a2c8e06031d61bf3b23\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd\",\"lessThan\":\"06a6b606129c8a25cd457760f5370f3ff01fe05d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a0c2ccd9b5ad0a9e838158404e041b5a8ff762dd\",\"lessThan\":\"793b9b729f1e8de57be8c8daf1a9838be96cabed\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/mctp/mctp-serial.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.6,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06a6b606129c8a25cd457760f5370f3ff01fe05d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/36dc6d6964a3b90411cc7944cd9b8b6f67b9807b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/64b96ae7912244d55257aa330d9569ee0a8f8d99\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/68819427bc07eca7963a9e8be19e5272cc29186c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/793b9b729f1e8de57be8c8daf1a9838be96cabed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f80ba170d7b3a44e3d244a2c8e06031d61bf3b23\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-08-11T15:33:55+00:00",
      "cve": "CVE-2026-68124",
      "id": "CVE-2026-68124",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mctp: serial: handle zero-length frames to prevent rx buffer overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68124.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.