Wind River Support Network

HomeDefectsLIN1022-34353

Fixed

LIN1022-34353 : Security Advisory - linux - CVE-2026-98018

Created: Sep 25, 2026 Updated: Sep 29, 2026

Resolved Date: Sep 26, 2026

Found In Version: 10.22.33.2

Fix Version: 10.22.33.11

Severity: Standard

Applicable for: Wind River Linux LTS 22

Component/s: Kernel

Description

In the Linux kernel, the following vulnerability has been resolved:  net: mctp: i3c: serialize probe with bus removal  mctp_i3c_probe() drops busdevs_lock after finding the matching bus. A concurrent I3C_NOTIFY_BUS_REMOVE can then unregister and free the bus netdev before probe passes its private data to mctp_i3c_add_device(). The latter consequently adds a list node through a freed mbus pointer.  Keep busdevs_lock held until the device has been added. This also satisfies the __must_hold annotation on mctp_i3c_add_device().
Data source: kernel.org (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

CVEs

CVE-2026-98018