CVE-2026-45865: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45865 Overview

CVE-2026-45865 is an uninitialized memory use vulnerability in the Linux kernel mctp-i2c driver. The event handler did not initialize the bytes returned during I2C reads on an mctp-i2c device. As a result, reads returned the val field from the I2C bus driver, which on i2c-aspeed and i2c-npcm7xx is a stack-uninitialized u8. This allowed callers performing I2C reads against an mctp-i2c instance to receive kernel stack contents instead of defined data. The fix initializes the read bytes to 0xff, so commands like i2ctransfer -y 1 r10@0x34 now return all 0xff as expected.

Critical Impact
Reads against an mctp-i2c device returned uninitialized kernel stack memory, exposing potentially sensitive kernel data to local callers with I2C access.

Affected Products

Linux kernel mctp-i2c driver
Systems using the i2c-aspeed bus driver
Systems using the i2c-npcm7xx bus driver

Discovery Timeline

2026-05-27 - CVE-2026-45865 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45865

Vulnerability Analysis

The Management Component Transport Protocol (MCTP) over I2C subsystem in the Linux kernel exposes character-style I2C reads through the mctp-i2c device. When a user issued an I2C read against this device, the event handler did not populate the response buffer. The bus driver layer then returned its internal val byte, which in the i2c-aspeed and i2c-npcm7xx drivers is an uninitialized u8 on the kernel stack. The resulting read leaked whatever byte happened to occupy that stack slot at the time of the call.

This behavior falls under uninitialized memory use [CWE-908]. While each call leaks only a single byte per read transaction, repeated reads against the device can be used to sample stack contents over time. Such leaks can disclose pointer values, function return addresses, or transient data placed on the kernel stack by recent syscalls.

Root Cause

The mctp-i2c event handler did not initialize the read buffer before returning data to the caller. The downstream I2C controller drivers (i2c-aspeed, i2c-npcm7xx) declared their response byte on the stack without zeroing it. With no producer writing the value, the consumer received uninitialized stack memory.

Attack Vector

Exploitation requires local access to an I2C device node such as /dev/i2c-N with permission to issue read transactions against an mctp-i2c slave address. A local attacker with this access can repeatedly invoke reads, for example through i2ctransfer or the I2C_RDWR ioctl, and collect the returned byte stream to reconstruct kernel stack contents. The vulnerability does not provide write primitives or direct code execution. Its primary value to an attacker is as an information disclosure step that supports defeating kernel address space layout randomization (KASLR) or staging a follow-on exploit.

No public proof-of-concept exploit code is published. The upstream commit message documents the reproducer i2ctransfer -y 1 r10@0x34 used to verify the fix.

Detection Methods for CVE-2026-45865

Indicators of Compromise

Unexpected user-space processes opening /dev/i2c-* device nodes on systems exposing mctp-i2c to non-root users.
High-frequency I2C_RDWR ioctl activity targeting an MCTP slave address from non-platform-management processes.
Presence of i2ctransfer, i2cdump, or custom I2C tooling on production hosts where no legitimate I2C workflow exists.

Detection Strategies

Audit kernel version and configuration for the unpatched mctp-i2c driver on hosts using i2c-aspeed or i2c-npcm7xx controllers, including BMC and server management firmware stacks.
Use kernel auditing (auditd) to log openat and ioctl calls on /dev/i2c-* nodes and alert on access by unexpected UIDs.
Review udev rules and device permissions to identify whether I2C device nodes are accessible to non-privileged users.

Monitoring Recommendations

Track installed kernel package versions across managed servers and BMCs to confirm the fix from the upstream stable commits is deployed.
Monitor for new local accounts or services gaining membership in groups that grant I2C device access.
Correlate I2C device access events with subsequent privilege escalation or kernel exploit indicators on the same host.

How to Mitigate CVE-2026-45865

Immediate Actions Required

Update affected systems to a Linux kernel that includes the upstream stable fix for the mctp-i2c event handler.
Restrict access to /dev/i2c-* device nodes to root or a tightly controlled group, and remove unnecessary I2C tooling from production hosts.
Inventory baseboard management controllers and server platforms that rely on i2c-aspeed or i2c-npcm7xx and prioritize them for patching.

Patch Information

The vulnerability is resolved upstream in the Linux kernel by initializing the I2C read bytes to 0xff in the mctp-i2c event handler. Stable backports are available in the following commits: 11f8325324406, 1eeedb310229, 2a14e91b6d76, 6ff2ebfef75f, 93e01e837e10, and fa9861e5c8af. Apply the kernel update appropriate for your distribution's supported series.

Workarounds

Disable the mctp-i2c driver on systems that do not require MCTP over I2C functionality until the kernel can be updated.
Tighten permissions on /dev/i2c-* device nodes via udev rules so only privileged management processes can issue reads.
Remove I2C user-space tools such as i2ctransfer and i2cdump from hosts where they are not operationally required.

bash

# Configuration example: restrict I2C device node access via udev
# /etc/udev/rules.d/99-i2c-restrict.rules
KERNEL=="i2c-[0-9]*", MODE="0600", OWNER="root", GROUP="root"

# Reload udev rules
sudo udevadm control --reload-rules
sudo udevadm trigger