CVE-2026-79976: memory-safety in zephyrproject zephyr

The vulnerability exists in the MCTP-over-I2C+GPIO target binding code (subsys/pmci/mctp/mctp_i2c_gpio_target.c) of Zephyr. When an I2C STOP is issued, the selected register (b->reg_addr) and data-phase flag (b->rxtx) are not cleared, leaving stale state. A controller can trigger this by performing a normal packet write followed by a STOP, then a bare read followed by a STOP. This leads to a NULL packet being passed to mctp_bus_rx() or dereferencing a cleared transmit packet buffer, causing a fatal exception or dropped packets. The flaw results in denial of service due to device reset or halt on targets that trap address 0 accesses. The fix involves resetting b->reg_addr and clearing b->rxtx at every STOP, requiring a new register selection before data phases. Only builds with CONFIG_MCTP and CONFIG_MCTP_I2C_GPIO_TARGET enabled are affected.

An attacker with control over the I2C bus controller can cause a denial of service by triggering fatal exceptions or device resets on affected Zephyr targets. The vulnerability does not allow confidentiality or integrity compromise, nor does it permit arbitrary code execution. On hardware where address 0 is readable, the impact is limited to malformed packet buffers and dropped outbound packets. The vulnerability requires no authentication and can be exploited by ordinary I2C transactions.

A fix is available that resets the register selection and data-phase flag on every I2C STOP condition. Users should upgrade to a Zephyr version that includes this fix. Only builds with the experimental CONFIG_MCTP subsystem and CONFIG_MCTP_I2C_GPIO_TARGET enabled are affected, so disabling these options can also mitigate the issue. Patch status is not explicitly provided; check the Zephyr vendor advisory for the current remediation status and apply official fixes as recommended.