CVE-2026-98238

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

CVE-2026-98238 net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

EUVD-2026-93166

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

CVE-2026-98238

The Linux kernel contains an out-of-bounds read vulnerability in the t7xx wwan driver. The t7xx_ccmni_recv_skb() function fails to perform a bounds check on the netif index carried in the DPMAIF PIT header . Because the index is five bits wide but the ccmni_inst[] array only supports up to NIC_DE...

CVE-2026-98237

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...

CVE-2026-98238

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

CVE-2026-98236

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

PT-2026-106567

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xx ccmni recv skb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmni inst only has room for NIC DEV MAX 21 entries. t7xx ccmni recv skb indexes the array...

PT-2026-106565

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi wwan mbim: check skb copy bits return value mhi mbim rx ignores the return value of skb copy bits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked...

Linux Distros Unpatched Vulnerability : CVE-2026-98236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagr...

Linux Distros Unpatched Vulnerability : CVE-2026-98238

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room fo...

CVE-2026-72029: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: bound device offsets in the MUX downlink decoder muxdladbdecode walks a chain of aggregated datagram tables using offsets and lengths taken from the modem. firsttableindex, nexttableindex, tablelength,...

CVE-2026-43495

A flaw was found in the Linux kernel, specifically within the net: wwan: t7xx module. A malicious modem could exploit this vulnerability by sending a specially crafted message with an invalid portcount value. This could lead to a slab-out-of-bounds read, potentially allowing an attacker to access...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38123)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38123 advisory. - In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Fix napi rx poll issue...

CVE-2025-38123

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Fix napi rx poll issue When driver handles the napi rx polling requests, the netdev might have been released by the dellink logic triggered by the disconnect operation on user plane. However, in the logic of...

CVE-2024-50128

In the Linux kernel, the following vulnerability has been resolved: net: wwan: fix global oob in wwanrtnlpolicy The variable wwanrtnllinkops assign a bigger maxtype which leads to a global out-of-bounds read when parsing the netlink attributes. Exactly same bug cause as the oob fixed in commit...

CVE-2022-48963: Missing Release of Memory after Effective Lifetime

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix memory leak in ipcmuxinit When failed to alloc ipcmux-uladb.ppqlt in ipcmuxinit, ipcmux is not released...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2024-40939

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: Fix tainted pointer delete is case of region creation fail In case of region creation fail in ipcdevlinkcreateregion, previously created regions delete process starts from tainted pointer which actually holds err...

CVE-2024-40939 net: wwan: iosm: Fix tainted pointer delete is case of region creation fail

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: Fix tainted pointer delete is case of region creation fail In case of region creation fail in ipcdevlinkcreateregion, previously created regions delete process starts from tainted pointer which actually holds err...