CVE-2026-10678: Zephyr MCTP-over-I2C DOS Vulnerability

CVE-2026-10678 Overview

CVE-2026-10678 affects the Management Component Transport Protocol (MCTP) over I2C+GPIO target binding in the Zephyr real-time operating system. The vulnerable code resides in subsys/pmci/mctp/mctp_i2c_gpio_target.c and processes pseudo-register writes from an I2C bus master without validating the order of operations or the state of the receive buffer. A malicious or malfunctioning I2C controller on the same bus can trigger a NULL pointer dereference by selecting the data register before the length register. The same handler contains a write-then-check bounds test, permitting a one-byte heap overflow at data[255] when more than 255 data bytes are sent. The flaw was introduced when the I2C+GPIO target binding was added, shipping in Zephyr v4.3.0 and v4.4.0.

Critical Impact
An adjacent attacker with I2C bus master capability can corrupt memory or crash the target device without any prior protocol state or authentication.

Affected Products

Zephyr RTOS v4.3.0
Zephyr RTOS v4.4.0
Devices implementing the mctp_i2c_gpio_target binding

Discovery Timeline

2026-07-21 - CVE-2026-10678 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-10678

Vulnerability Analysis

The mctp_i2c_gpio_target_write_received() function processes incoming I2C bytes based on a pseudo-register selector supplied by the bus master. The MCTP_I2C_GPIO_RX_MSG_ADDR (data) handler dereferences b->rx_pkt and writes the incoming byte through it. Allocation of rx_pkt only occurs when the bus master first writes the length register. A controller that skips the length register and writes directly to the data register triggers a write through a NULL or unallocated mctp_pktbuf pointer [CWE-476]. Because the offset into the buffer is attacker-advanceable, subsequent writes land at small offsets above address 0.

The same handler additionally performs its bounds check after the store, allowing a one-byte heap overflow at data[255] once more than 255 data bytes are streamed. Both defects impact integrity and availability of the target device.

Root Cause

The binding assumes a specific protocol order: the bus master must write the length register before writing data bytes. Nothing in the handler enforces this order. The receive buffer pointer b->rx_pkt is never checked for NULL before dereference. The bounds test on rx_idx executes after the byte has already been written into the buffer.

Attack Vector

The I2C target callback executes on raw bytes from whatever device holds the bus master role. The binding performs no authentication of the peer controller. An attacker with adjacent-network access to the I2C bus can send crafted register selections and data bytes to reach either the NULL dereference path or the one-byte overflow path without establishing any prior MCTP session state.

// Security patch: subsys/pmci/mctp/mctp_i2c_gpio_controller.c
// Adds NULL check after mctp_pktbuf_alloc()
	struct mctp_pktbuf *pkt = mctp_pktbuf_alloc(&b->binding, b->rx_buf_len);
+	if (pkt == NULL) {
+		LOG_ERR("Failed to allocate pktbuf");
+		return;
+	}

	memcpy(pkt->data, b->rx_buf, b->rx_buf_len);
// Source: https://github.com/zephyrproject-rtos/zephyr/commit/9e23364261a2188c171d734d6947e02ee2a9510f

// Security patch: include/zephyr/pmci/mctp/mctp_i2c_gpio_target.h
// Adds expected-length tracking field to defer allocation safely
 	uint8_t reg_addr;
 	bool rxtx;
 	uint8_t rx_idx;
+	uint8_t rx_exp_len;
 	struct mctp_pktbuf *rx_pkt;
 	struct k_sem *tx_lock;
 	struct k_sem *tx_complete;
// Source: https://github.com/zephyrproject-rtos/zephyr/commit/9e23364261a2188c171d734d6947e02ee2a9510f

Detection Methods for CVE-2026-10678

Indicators of Compromise

Unexpected hard faults or resets on Zephyr devices exposing an MCTP-over-I2C+GPIO target endpoint.
Kernel log entries indicating NULL pointer dereference within mctp_i2c_gpio_target_write_received().
I2C bus traces showing writes to the data pseudo-register without a preceding length register write.

Detection Strategies

Instrument firmware builds with sanitizer options that trap on NULL dereferences and out-of-bounds writes during pre-production I2C fuzzing.
Correlate device watchdog resets with I2C traffic patterns to identify anomalous bus master behavior.
Compare deployed Zephyr firmware versions against v4.3.0 and v4.4.0 to enumerate affected assets.

Monitoring Recommendations

Log MCTP framing errors and buffer allocation failures emitted by the patched LOG_ERR("Failed to allocate pktbuf") path after remediation.
Track I2C bus errors and unexpected controller behavior on platforms shared between trusted and less-trusted components.
Alert on repeated target-side crashes that could indicate active probing of the vulnerable code path.

How to Mitigate CVE-2026-10678

Immediate Actions Required

Inventory devices running Zephyr v4.3.0 or v4.4.0 that enable the mctp_i2c_gpio_target binding.
Apply the upstream fix from commit 9e23364261a2188c171d734d6947e02ee2a9510f and rebuild firmware.
Restrict physical and logical access to shared I2C buses hosting affected target devices until patched images are deployed.

Patch Information

The fix defers packet buffer allocation to the first data byte and adds a NULL check on the allocation result. A missing length register write is treated as a zero-sized packet and rejected by libmctp. The bounds check on rx_idx is moved before the store to eliminate the one-byte overflow. See the Zephyr GitHub Security Advisory GHSA-pmwm-5rcm-39rr and the upstream commit for the full patch.

Workarounds

Disable the MCTP-over-I2C+GPIO target binding in the Zephyr configuration on devices that do not require it.
Ensure only trusted controllers share the I2C bus with affected targets, since the binding performs no peer authentication.
Add hardware-level bus isolation or an intermediate arbiter that filters malformed MCTP register sequences.

bash

# Verify Zephyr version and confirm patched commit is present
west list zephyr
cd zephyr && git log --oneline | grep 9e23364261a2188c171d734d6947e02ee2a9510f

# Disable the vulnerable binding via Kconfig if MCTP-I2C+GPIO is not needed
# In prj.conf:
# CONFIG_MCTP_I2C_GPIO_TARGET=n