CVE-2026-98018
Unknown
Description
In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctp_i3c_probe() drops busdevs_lock after finding the matching bus. A concurrent I3C_NOTIFY_BUS_REMOVE can then unregister and free the bus netdev before probe passes its private data to mctp_i3c_add_device(). The latter consequently adds a list node through a freed mbus pointer. Keep busdevs_lock held until the device has been added. This also satisfies the __must_hold annotation on mctp_i3c_add_device().
SeverityUnknown
CVSS—
Exploit probability—
Product
Linux
PublishedSep 25, 2026
First seenSep 25, 2026
How to fix
Update
- Linux Linuxe6541b2747682fdb2c6ded4a7cf7c39c4067a35c, 765c5e357e67916a7aac8ead4ac2fa7d2bffe000, 906d8dbafabfa81a30e3ade420cb9912f223a5e1, 2b4707a149a55e8fa75c9ef32b359d60f470a566 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 ≤ v < e6541b2747682fdb2c6ded4a7cf7c39c4067a35c, c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 ≤ v < 765c5e357e67916a7aac8ead4ac2fa7d2bffe000, c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 ≤ v < 906d8dbafabfa81a30e3ade420cb9912f223a5e1, c8755b29b58ec65be17bcb8c40763d2dcb1f1db5 ≤ v < 2b4707a149a55e8fa75c9ef32b359d60f470a566, 6.7 | e6541b2747682fdb2c6ded4a7cf7c39c4067a35c, 765c5e357e67916a7aac8ead4ac2fa7d2bffe000, 906d8dbafabfa81a30e3ade420cb9912f223a5e1, 2b4707a149a55e8fa75c9ef32b359d60f470a566 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.