CVE-2026-43495

What it actually does

This vulnerability is an out-of-bounds read in the Linux kernel t7xx WWAN modem driver. The driver trusts modem-supplied length/count fields while parsing WWAN port enumeration and runtime feature messages. A malformed message can cause the kernel to read beyond the bounds of the received buffer, potentially exposing kernel memory, triggering kernel warnings or crashes, and in worst cases contributing to broader kernel compromise depending on build configuration, memory layout, and exploitability of adjacent code paths. The attack surface is adjacent/local to systems using affected t7xx WWAN modem hardware or exposed modem communication paths.

Why it matters to the business

Organizations using Linux systems with affected WWAN modem hardware may face device instability, kernel crashes, loss of cellular connectivity, or potential exposure of sensitive kernel memory. Because this is in kernel-space code, successful exploitation can affect the reliability and security of the entire host. It is not currently listed in CISA KEV, has no known public exploit maturity in the supplied data, and has a low EPSS score, so remediation should be prioritized for fleets that actually use t7xx-based cellular modems, mobile/edge devices, gateways, laptops, or embedded Linux deployments.

How an attack unfolds

An attacker would need the ability to influence messages delivered from the WWAN modem path to the Linux t7xx driver, such as through a malicious, compromised, emulated, or otherwise controllable modem/baseband communication channel. The attacker crafts a malformed port enumeration or runtime feature message where the declared count or length fields are inconsistent with the actual message size. When the vulnerable kernel parses the message, it uses attacker-controlled fields to continue reading past the end of the buffer. This can produce kernel out-of-bounds reads, leak memory contents in debug/crash contexts, or crash the system. Exploitation is constrained by the need to reach this modem-driver parsing path and is most relevant on systems with the affected WWAN hardware and driver enabled.

How to fix it

Update the Linux kernel to a vendor-supported version that includes the t7xx WWAN driver fixes for validating message length before reading port enumeration and runtime feature data. No exact fixed versions were provided in the input, so use distribution security advisories and kernel changelogs to identify packages containing the fix for CVE-2026-43495. Where immediate patching is not possible, reduce exposure by disabling the t7xx WWAN driver/module if cellular modem functionality is not required, blocking or removing untrusted WWAN modem hardware, restricting physical access to systems with affected modems, and prioritizing patching for mobile, edge, embedded, and remote-access devices that rely on cellular connectivity.

How to confirm the fix worked

Confirm that the running kernel package includes the upstream fix by checking the distribution advisory, package changelog, or source patch history for changes to t7xx_port_enum_msg_handler() and t7xx_parse_host_rt_data() that pass and validate message length, check sizeof(*port_msg), validate struct_size() against port_count, and verify runtime feature buffer lengths before parsing. On systems where source is available, verify that the t7xx driver no longer loops over modem-supplied port_count without checking the received message length. Confirm whether the t7xx driver is present or loaded using kernel module inventory and hardware inventory. After remediation, reboot into the fixed kernel and verify that the active kernel version matches the patched package, not merely that the package is installed.

Typical attack path

1. Identify a Linux system using the affected t7xx WWAN modem driver or a device class likely to include it.
2. Gain the ability to influence modem-to-host control messages, such as through malicious modem firmware, compromised baseband behavior, physical/adjacent hardware access, or an emulated modem path.
3. Send a malformed port enumeration or runtime feature message with a large or inconsistent port_count, data_len, or feature length field.
4. Trigger the vulnerable parser in the kernel driver during modem enumeration, handshake, or runtime feature parsing.
5. Cause the kernel to read beyond the valid message buffer, potentially resulting in kernel memory disclosure, kernel warnings, driver failure, or host crash.
6. Use any resulting information disclosure or instability to support further compromise or denial-of-service objectives.

How to detect it

To determine whether this may already have been exploited, review kernel logs, system journals, crash dumps, and hardware event logs from systems with t7xx WWAN devices. Look for kernel oopses, panics, KASAN or UBSAN reports, slab-out-of-bounds reads, unexpected modem resets, repeated WWAN enumeration failures, or crashes referencing t7xx_port_enum_msg_handler(), t7xx_parse_host_rt_data(), DPMAIF, or the t7xx driver. Correlate events with insertion, reset, resume, or initialization of cellular modem hardware. Because exploitation occurs inside kernel driver parsing and may not create traditional network indicators, host kernel telemetry and crash artifacts are the most useful sources. If available, inspect vmcore/kdump data for stack traces involving the t7xx WWAN driver and preserve affected modem firmware/version information for investigation.

• t7xx_port_enum_msg_handler
• t7xx_parse_host_rt_data
• slab-out-of-bounds
• KASAN: slab-out-of-bounds
• BUG: KASAN
• kernel BUG
• Oops:
• general protection fault
• DPMAIF
• mtk_t7xx
• t7xx
• wwan
• port_count=65535
• /drivers/net/wwan/t7xx/
• drivers/net/wwan/t7xx/t7xx_port.c

What your security team should do

• Inventory Linux systems with WWAN/cellular modem hardware and determine whether the t7xx driver is present, loaded, or built into the kernel.
• Prioritize kernel updates for laptops, mobile workstations, IoT/edge gateways, embedded systems, and remote sites using affected cellular connectivity.
• If WWAN functionality is unnecessary, disable or blacklist the t7xx driver as a temporary risk-reduction measure until patching is complete.
• Monitor kernel logs, crash dumps, and EDR telemetry for t7xx driver crashes, KASAN out-of-bounds reports, modem enumeration failures, or unexplained WWAN resets.
• Treat suspicious modem-driver crashes as potentially security-relevant, especially if they occur repeatedly or after attaching/reinitializing cellular hardware.
• Ensure devices boot into the patched kernel after update; stale running kernels remain vulnerable until rebooted.
• Track vendor advisories for exact fixed package versions because no fixed version list was provided in the input.