# CVE-2026-68124: mctp: serial: handle zero-length frames to prevent rx buffer overflow CVE-2026-68124 is fixed in 17 products on 1 platform, first by DEBIAN-CVE-2026-68124, released August 11, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-68124 - Priority: High - CVSS: 9.6 (Important) - EPSS: 0.0034 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 10, 2026 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68124 ## Description In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctp_serial_push_header() case 2 and validates it upper-bound-only: if (c > MCTP_SERIAL_FRAME_MTU) { dev->rxstate = STATE_ERR; } else { dev->rxlen = c; dev->rxpos = 0; dev->rxstate = STATE_DATA; ... } A length of zero passes this check, so rxlen is set to 0 and the state machine advances to STATE_DATA. In mctp_serial_push() STATE_DATA, the incoming byte is stored and rxpos incremented before the terminator is dev->rxbuf[dev->rxpos] = c; dev->rxpos++; dev->rxstate = STATE_DATA; if (dev->rxpos == dev->rxlen) { dev->rxpos = 0; dev->rxstate = STATE_TRAILER; } With rxlen == 0 the "rxpos == rxlen" terminator can never fire (rxpos is already 1 on the first data byte), so subsequent bytes are written past the end of the fixed 74-byte rxbuf, which is the last member of the netdev private area. Every following data byte is an attacker-controlled 1-byte out-of-bounds heap write, and the overflow continues until a frame (0x7e) or escape byte resets the parser -- effectively unbounded. Reaching this requires CAP_NET_ADMIN to attach the N_MCTP line discipline and bring the resulting mctpserialN netdev up, after which the bytes arrive via the tty receive path. Route a zero-length frame straight to STATE_TRAILER instead of STATE_DATA. The trailer/framing bytes are still consumed, and the frame resolves to a zero-length skb that the MCTP core rejects; the parser never enters STATE_DATA with rxlen == 0, so the out-of-bounds write can no longer occur. KASAN, on a frame of 0x7e 0x01 0x00 followed by data bytes (before this change): UBSAN: array-index-out-of-bounds in drivers/net/mctp/mctp-serial.c:370 index 74 is out of range for type 'u8 [74]' BUG: KASAN: slab-out-of-bounds in mctp_serial_tty_receive_buf Write of size 1 at addr ... by task kworker/u16:0 mctp_serial_tty_receive_buf tty_ldisc_receive_buf flush_to_ldisc Allocated by task 152: alloc_netdev_mqs mctp_serial_open v2: route zero-length frames to STATE_TRAILER instead of STATE_ERR so the trailer/framing bytes are still consumed (Jeremy Kerr). Found by 0sec automated security-research tooling (https://0sec.ai). ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | dtb-aarch64 opensuse-leap 16.0 | 6.12.0-160000.38.1 | [OPENSUSE-SU-2026:21910-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21910-1.md) | Sep 22, 2026 | | Linux | kernel-64kb opensuse-leap 16.0 | 6.12.0-160000.38.1 | [OPENSUSE-SU-2026:21910-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21910-1.md) | Sep 22, 2026 | | Linux | kernel-64kb sles 15.7 | 6.4.0-150700.53.81.1 | [SUSE-SU-2026:4254-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4254-1.md) | Oct 7, 2026 | | Linux | kernel-64kb sles 16.0 | 6.12.0-160000.38.1 | [SUSE-SU-2026:23902-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23902-1.md) | Sep 22, 2026 | | Linux | kernel-azure opensuse-leap 16.0 | 6.12.0-160000.38.1 | [OPENSUSE-SU-2026:21910-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21910-1.md) | Sep 22, 2026 | | Linux | kernel-azure sles 15.7 | 6.4.0-150700.53.81.1 | [SUSE-SU-2026:4254-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4254-1.md) | Oct 7, 2026 | | Linux | kernel-azure sles 16.0 | 6.12.0-160000.38.1 | [SUSE-SU-2026:23902-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23902-1.md) | Sep 22, 2026 | | Linux | kernel-default opensuse-leap 16.0 | 6.12.0-160000.38.1 | [OPENSUSE-SU-2026:21910-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21910-1.md) | Sep 22, 2026 | | Linux | kernel-default sles 15.7 | 6.4.0-150700.53.81.1 | [SUSE-SU-2026:4254-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4254-1.md) | Oct 7, 2026 | | Linux | kernel-default sles 16.0 | 6.12.0-160000.38.1 | [SUSE-SU-2026:23902-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23902-1.md) | Sep 22, 2026 | | Linux | kernel-default-base opensuse-leap 16.0 | 6.12.0-160000.38.1.160000.2.22 | [OPENSUSE-SU-2026:21910-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21910-1.md) | Sep 22, 2026 | | Linux | kernel-default-base sles 15.7 | 6.4.0-150700.53.81.1.150700.17.45.1 | [SUSE-SU-2026:4254-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4254-1.md) | Oct 7, 2026 | | Linux | kernel-default-base sles 16.0 | 6.12.0-160000.38.1.160000.2.23 | [SUSE-SU-2026:23902-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23902-1.md) | Sep 22, 2026 | | Linux | kernel-docs opensuse-leap 16.0 | 6.12.0-160000.38.1 | [OPENSUSE-SU-2026:21910-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21910-1.md) | Sep 22, 2026 | | Linux | kernel-docs sles 15.7 | 6.4.0-150700.53.81.1 | [SUSE-SU-2026:4254-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4254-1.md) | Oct 7, 2026 | | Linux | kernel-docs sles 16.0 | 6.12.0-160000.38.1 | [SUSE-SU-2026:23902-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23902-1.md) | Sep 22, 2026 | | Linux | kernel-kvmsmall opensuse-leap 16.0 | 6.12.0-160000.38.1 | [OPENSUSE-SU-2026:21910-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21910-1.md) | Sep 22, 2026 | | Linux | kernel-kvmsmall sles 16.0 | 6.12.0-160000.38.1 | [SUSE-SU-2026:23902-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23902-1.md) | Sep 22, 2026 | | Linux | kernel-livepatch-SLE15-SP7-RT_Update_20 sles 15.7 | 1-150700.1.3.1 | [SUSE-SU-2026:4120-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4120-1.md) | Sep 10, 2026 | | Linux | kernel-livepatch-SLE15-SP7_Update_21 sles 15.7 | 1-150700.15.3.1 | [SUSE-SU-2026:4254-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4254-1.md) | Oct 7, 2026 | | Linux | kernel-obs-build opensuse-leap 16.0 | 6.12.0-160000.38.1 | [OPENSUSE-SU-2026:21910-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21910-1.md) | Sep 22, 2026 | | Linux | kernel-obs-build sles 15.7 | 6.4.0-150700.53.81.1 | [SUSE-SU-2026:4254-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4254-1.md) | Oct 7, 2026 | | Linux | kernel-obs-qa opensuse-leap 16.0 | 6.12.0-160000.38.1 | [OPENSUSE-SU-2026:21910-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21910-1.md) | Sep 22, 2026 | | Linux | kernel-obs-qa sles 16.0 | 6.12.0-160000.38.1 | [SUSE-SU-2026:23902-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23902-1.md) | Sep 22, 2026 | | Linux | kernel-rt opensuse-leap 16.0 | 6.12.0-160000.38.1 | [OPENSUSE-SU-2026:21910-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21910-1.md) | Sep 22, 2026 | | Linux | kernel-source opensuse-leap 16.0 | 6.12.0-160000.38.1 | [OPENSUSE-SU-2026:21910-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21910-1.md) | Sep 22, 2026 | | Linux | kernel-source sles 15.7 | 6.4.0-150700.53.81.1 | [SUSE-SU-2026:4254-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4254-1.md) | Oct 7, 2026 | | Linux | kernel-source sles 16.0 | 6.12.0-160000.38.1 | [SUSE-SU-2026:23902-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23902-1.md) | Sep 22, 2026 | | Linux | kernel-syms opensuse-leap 16.0 | 6.12.0-160000.38.1 | [OPENSUSE-SU-2026:21910-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21910-1.md) | Sep 22, 2026 | | Linux | kernel-syms sles 15.7 | 6.4.0-150700.53.81.1 | [SUSE-SU-2026:4254-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4254-1.md) | Oct 7, 2026 | | Linux | kernel-syms sles 16.0 | 6.12.0-160000.38.1 | [SUSE-SU-2026:23902-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23902-1.md) | Sep 22, 2026 | | Linux | kernel-zfcpdump opensuse-leap 16.0 | 6.12.0-160000.38.1 | [OPENSUSE-SU-2026:21910-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21910-1.md) | Sep 22, 2026 | | Linux | kernel-zfcpdump sles 15.7 | 6.4.0-150700.53.81.1 | [SUSE-SU-2026:4254-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4254-1.md) | Oct 7, 2026 | | Linux | kernel-zfcpdump sles 16.0 | 6.12.0-160000.38.1 | [SUSE-SU-2026:23902-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23902-1.md) | Sep 22, 2026 | | Linux | linux Debian 12.15 (bookworm) | 6.1.187-1 | [DEBIAN-CVE-2026-68124](https://patchblox.com/security/data/fix/linux/debian-cve-2026-68124.md) | Aug 11, 2026 | | Linux | linux Debian 13.5 (trixie) | 6.12.101-1 | [DEBIAN-CVE-2026-68124](https://patchblox.com/security/data/fix/linux/debian-cve-2026-68124.md) | Aug 11, 2026 | | Linux | linux Debian 14 | 7.1.6-1 | [DEBIAN-CVE-2026-68124](https://patchblox.com/security/data/fix/linux/debian-cve-2026-68124.md) | Aug 11, 2026 | | Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.101-1~deb12u1 | [DEBIAN-CVE-2026-68124](https://patchblox.com/security/data/fix/linux/debian-cve-2026-68124.md) | Aug 11, 2026 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.