SB20260528217 - Use of Uninitialized Variable in Linux kernel net mctp driver
Published: May 28, 2026
Security Bulletin ID
SB20260528217
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Use of Uninitialized Variable (CVE-ID: CVE-2026-45865)
CWE-ID: CWE-457 - Use of Uninitialized Variable
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to use of uninitialized memory in the mctp i2c event handler read path when handling i2c read requests to an mctp-i2c device. A local user can issue crafted i2c read operations to disclose sensitive information.
The issue was observed with certain i2c bus drivers returning a stack uninitialized byte value during reads.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/11f83253244060b5de5eac787f61ae3f3e559d01
- https://git.kernel.org/stable/c/1eeedb310229bfee9dd4d992e5bba33fe1378a8f
- https://git.kernel.org/stable/c/2a14e91b6d76639dac70ea170f4384c1ee3cb48d
- https://git.kernel.org/stable/c/6ff2ebfef75fbc57d937d8fbe738b967edf2d331
- https://git.kernel.org/stable/c/93e01e837e105299f1c259ef71f6e1ec4fe806e3
- https://git.kernel.org/stable/c/fa9861e5c8af7651dddfa8d490aaada17ae33b6c