Linux Kernel CVE-2026-43457

The affected subsystem is the Linux kernel's MCTP (Management Component Transport Protocol) I2C driver, which enables MCTP communication over I2C bus interfaces - a protocol primarily used in server platform management environments for BMC-to-host communication. CWE-401 (Missing Release of Memory after Effective Lifetime) identifies the root cause: the receive path allocates a socket buffer (skb) to hold incoming I2C frame data, but when midev->allow_rx evaluates to false, the code bypasses the netif_rx() call that would normally hand skb ownership to the network stack for eventual freeing. No explicit kfree_skb() is called on this conditional branch, so the allocated memory is permanently leaked. Repeated triggering of this path - possible whenever MCTP I2C receive events occur during a period when allow_rx is false (typically during interface initialization or teardown) - can progressively exhaust kernel slab allocations. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.