Linux kernel t7xx_port_ctrl_tx Heap Buffer Overflow DoS

The vulnerability of the t7xxportctrltx function in the drivers/net/wwan/t7xx/t7xxportwwan.c file of the Linux kernel is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-98238

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

UBUNTU-CVE-2026-98238

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

CVE-2026-98238 net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

EUVD-2026-93166

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

CVE-2026-98238

The Linux kernel contains an out-of-bounds read vulnerability in the t7xx wwan driver. The t7xx_ccmni_recv_skb() function fails to perform a bounds check on the netif index carried in the DPMAIF PIT header . Because the index is five bits wide but the ccmni_inst[] array only supports up to NIC_DE...

CVE-2026-98238

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

CVE-2026-98237

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...

CVE-2026-98236

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

PT-2026-115751

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi wwan mbim: check skb copy bits return value mhi mbim rx ignores the return value of skb copy bits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked...

CVE-2026-98238: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

PT-2026-106567

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An out-of-bounds read exists in the t7xx ccmni recv skb function. The netif index in the DPMAIF PIT header is five bits wide, allowing values up to 31, while the ccmni inst array only...

Linux Distros Unpatched Vulnerability : CVE-2026-98238

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room fo...

Linux Distros Unpatched Vulnerability : CVE-2026-98236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagr...

PT-2026-106565

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description The mhi mbim rx function fails to check the return value of skb copy bits when copying datagrams from the NTB Network Transfer Buffer. Because the datagram offset and length are provided by...

CVE-2026-72029 net: wwan: iosm: bound device offsets in the MUX downlink decoder

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: bound device offsets in the MUX downlink decoder muxdladbdecode walks a chain of aggregated datagram tables using offsets and lengths taken from the modem. firsttableindex, nexttableindex, tablelength,...

CVE-2026-72029: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: bound device offsets in the MUX downlink decoder muxdladbdecode walks a chain of aggregated datagram tables using offsets and lengths taken from the modem. firsttableindex, nexttableindex, tablelength,...

PT-2026-116268

Уязвимость функции t7xx port ctrl tx файла drivers/net/wwan/t7xx/t7xx port wwan.c ядра операционной системы Linux связана с разыменованием указателей. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

CVE-2026-43495

A flaw was found in the Linux kernel, specifically within the net: wwan: t7xx module. A malicious modem could exploit this vulnerability by sending a specially crafted message with an invalid portcount value. This could lead to a slab-out-of-bounds read, potentially allowing an attacker to access...

CVE-2026-23172 net: wwan: t7xx: fix potential skb->frags overflow in RX path

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: fix potential skb-frags overflow in RX path When receiving data in the DPMAIF RX path, the t7xxdpmaifsetfragtoskb function adds page fragments to an skb without checking if the number of fragments has exceeded...