Cloudanix VulnDB

CVE-2026-98237

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's handling of certain mobile broadband modems can lock up one processor core, making the system sluggish until the kernel is updated.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Infinite loop in mhi_mbim_rx() when wNextNdpIndex fails to advance, pinning one CPU core at 100% utilization with the thread never returning.

Why it matters to the business

A single core becomes unresponsive, degrading performance or causing system hangs on devices using this WWAN driver; low overall prevalence reduces blast radius but still disrupts affected hardware.

How an attack unfolds

An attacker or malicious modem supplies an NTB containing an NDP that points at itself or an earlier offset; the driver's receive callback enters mhi_mbim_rx() and loops indefinitely because the termination condition (wNextNdpIndex == 0) is never met.

How to fix it

Apply the upstream kernel patch that adds a non-increasing wNextNdpIndex check at retrieval time; rebuild and deploy the updated kernel on affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting mhi_mbim_rx() for the added comparison that ensures the next offset exceeds the current offset before continuing traversal.

Typical attack path

  1. Modem or fault injector delivers crafted NTB to mhi_wwan_mbim receive path
  2. mhi_mbim_rx() reads first NDP and follows wNextNdpIndex
  3. Offset remains equal or decreases, violating loop advancement assumption
  4. CPU spins forever inside the receive callback

How to detect it

Look for sustained 100% utilization on a single CPU core correlated with WWAN receive activity; kernel traces or ftrace showing indefinite residence inside mhi_mbim_rx() indicate exploitation.

What your security team should do

  • Prioritize kernel update on all systems exposing WWAN/MBIM interfaces
  • Monitor CPU usage on cores handling WWAN traffic for sustained 100% utilization
  • Test patched kernel in lab with synthetic cyclic-NDP test vectors before broad rollout

The record

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain The NDP traversal in mhi_mbim_rx() only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP, keeps the loop spinning forever on one CPU. Break out when the next NDP offset is not larger than the current one. Verified in a QEMU guest with a fault injector feeding the driver's receive callback an NTB whose single NDP points at itself: the unpatched driver spins in mhi_mbim_rx() with one CPU pinned at 100% and the thread never returns. With this check the loop terminates within one iteration. Changes in v2: move the non-increasing check to the wNextNdpIndex retrieval site, as suggested by Loic Poulain, instead of tracking the previous offset in a separate variable.

Affected packages

Ecosystem Package Introduced Fixed