PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45865 Linux CVE debrief

A vulnerability in the Linux kernel's MCTP (Management Component Transport Protocol) over I2C driver could expose uninitialized stack memory to userspace. The mctp-i2c driver failed to initialize the read buffer before performing I2C operations, causing reads to return whatever value happened to be in the 'val' variable from the I2C bus driver. For i2c-aspeed and i2c-npcm7xx drivers specifically, this was an uninitialized u8 on the stack. The fix ensures the event handler read bytes are initialized to 0xff before I2C reads, preventing information disclosure of kernel stack contents.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

System administrators running Linux kernels with MCTP over I2C support, particularly those using Aspeed (i2c-aspeed) or Nuvoton NPCM7xx (i2c-npcm7xx) I2C controllers. Embedded systems and BMC (Baseboard Management Controller) deployments using MCTP for out-of-band management are most likely affected.

Technical summary

The mctp-i2c driver in the Linux kernel did not initialize the read buffer ('val') before performing I2C read operations. When reading from an MCTP-I2C device, the driver would return the uninitialized value from the I2C bus driver's stack variable. For i2c-aspeed and i2c-npcm7xx drivers, this exposed up to one byte of uninitialized kernel stack memory per read. The vulnerability is an information disclosure issue where sensitive kernel memory could potentially be leaked to unprivileged userspace through MCTP I2C device reads. The fix initializes the read bytes to 0xff, ensuring consistent and safe return values when no data is available.

Defensive priority

medium

Recommended defensive actions

  • Apply the relevant stable kernel patch for your kernel version
  • Update to a kernel version containing the fix (check stable kernel releases)
  • For systems using MCTP over I2C with i2c-aspeed or i2c-npcm7xx drivers, prioritize patching
  • Verify MCTP I2C device reads return 0xff for unavailable data rather than variable values

Evidence notes

The vulnerability description and fix are sourced from the official CVE record and NVD entry. Multiple stable kernel commits are referenced, indicating backports to various kernel versions. The fix was tested with i2ctransfer demonstrating the corrected behavior returns 0xff instead of uninitialized data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45865 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45865

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45865 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45865

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/11f83253244060b5de5eac787f61ae3f3e559d01

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1eeedb310229bfee9dd4d992e5bba33fe1378a8f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2a14e91b6d76639dac70ea170f4384c1ee3cb48d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6ff2ebfef75fbc57d937d8fbe738b967edf2d331

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/93e01e837e105299f1c259ef71f6e1ec4fe806e3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fa9861e5c8af7651dddfa8d490aaada17ae33b6c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.