{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  mctp: serial: handle zero-length frames to prevent rx buffer overflow  The MCTP serial receive state machine reads a frame length byte in mctp_serial_push_header() case 2 and validates it upper-bound-only:  \tif (c \u003e MCTP_SERIAL_FRAME_MTU) { \t\tdev-\u003erxstate = STATE_ERR; \t} else { \t\tdev-\u003erxlen = c; \t\tdev-\u003erxpos = 0; \t\tdev-\u003erxstate = STATE_DATA; \t\t... \t}  A length of zero passes this check, so rxlen is set to 0 and the state machine advances to STATE_DATA. In mctp_serial_push() STATE_DATA, the incoming byte is stored and rxpos incremented before the terminator is  \tdev-\u003erxbuf[dev-\u003erxpos] = c; \tdev-\u003erxpos++; \tdev-\u003erxstate = STATE_DATA; \tif (dev-\u003erxpos == dev-\u003erxlen) { \t\tdev-\u003erxpos = 0; \t\tdev-\u003erxstate = STATE_TRAILER; \t}  With rxlen == 0 the \"rxpos == rxlen\" terminator can never fire (rxpos is already 1 on the first data byte), so subsequent bytes are written past the end of the fixed 74-byte rxbuf, which is the last member of the netdev private area. Every following data byte is an attacker-controlled 1-byte out-of-bounds heap write, and the overflow continues until a frame (0x7e) or escape byte resets the parser -- effectively unbounded.  Reaching this requires CAP_NET_ADMIN to attach the N_MCTP line discipline and bring the resulting mctpserialN netdev up, after which the bytes arrive via the tty receive path.  Route a zero-length frame straight to STATE_TRAILER instead of STATE_DATA. The trailer/framing bytes are still consumed, and the frame resolves to a zero-length skb that the MCTP core rejects; the parser never enters STATE_DATA with rxlen == 0, so the out-of-bounds write can no longer occur.  KASAN, on a frame of 0x7e 0x01 0x00 followed by data bytes (before this change):    UBSAN: array-index-out-of-bounds in drivers/net/mctp/mctp-serial.c:370   index 74 is out of range for type 'u8 [74]'   BUG: KASAN: slab-out-of-bounds in mctp_serial_tty_receive_buf   Write of size 1 at addr ... by task kworker/u16:0    mctp_serial_tty_receive_buf    tty_ldisc_receive_buf    flush_to_ldisc   Allocated by task 152:    alloc_netdev_mqs    mctp_serial_open  v2: route zero-length frames to STATE_TRAILER instead of STATE_ERR so     the trailer/framing bytes are still consumed (Jeremy Kerr).  Found by 0sec automated security-research tooling (https://0sec.ai).",
  "id": "DEBIAN-CVE-2026-68124",
  "modified": "2026-09-14T16:47:29.384666103Z",
  "published": "2026-08-10T13:19:57.550Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-68124"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-68124"
  ]
}