Threading Vulnerability in MCTP over USB by Zephyr Project

CVE-2026-85032

What is CVE-2026-85032?

A vulnerability exists in the MCTP over USB device class of the Zephyr Project that can lead to memory corruption due to improper synchronization between threads handling USB data and system workqueues. The flaw arises when a USB host streams partial MCTP frames and initiates configuration changes or bus resets, creating a race condition that can exploit memory buffers. This weakness allows an attacker to manipulate the parsing process of incoming data and potentially gain unauthorized access without requiring user credentials.

References