Denial of Service Vulnerability in Zephyr Project's MCTP-over-I2C Target Binding

CVE-2026-79976

What is CVE-2026-79976?

A vulnerability exists in the MCTP-over-I2C target binding in the Zephyr Project where the state of a data register isn't cleared upon an I2C STOP command. This allows an attacker controlling a device on the shared bus to exploit the stale state, potentially leading to a denial of service. The issue arises when the bus controller executes a sequence of transactions which, due to improper handling of a null buffer, can result in fatal exceptions, device resets, or halts. Affected systems must apply the fix that ensures registers are reset appropriately at every STOP command to mitigate this vulnerability.

References