Cloudanix VulnDB

CVE-2026-98238

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux handles data from certain wireless modems can make the computer crash or act strangely.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in t7xx_ccmni_recv_skb() due to missing bounds check on 5-bit netif index (0-31) against 21-entry ccmni_inst[] array; index 21-31 lands in following callback table and is dereferenced as a struct t7xx_ccmni.

Why it matters to the business

Linux systems using t7xx WWAN hardware risk kernel crashes or memory corruption when processing malformed control packets, potentially causing denial of service on affected devices.

How an attack unfolds

An attacker able to influence the DPMAIF PIT header (via compromised modem firmware or hardware fault injection) supplies an index value 21-31; the driver performs an unchecked array access, reads a non-NULL callback pointer, and dereferences it to queue an skb.

How to fix it

Apply the upstream kernel patch that adds an explicit range check and drops skbs whose netif index exceeds NIC_DEV_MAX before array access in t7xx_ccmni_recv_skb().

How to confirm the fix worked

Confirm the bounds check (index < NIC_DEV_MAX) exists immediately before ccmni_inst[] indexing in the driver source; test with both valid indices (0-20) and out-of-range values (21-31) using a fault injector.

Typical attack path

  1. Obtain ability to craft or inject DPMAIF PIT headers
  2. Set netif index field to value 21-31
  3. Trigger t7xx_ccmni_recv_skb() via incoming skb
  4. Driver performs out-of-bounds dereference leading to crash or corruption

How to detect it

Search kernel ring buffer and system logs for oops traces or panic messages containing t7xx_ccmni_recv_skb, ccmni_inst, or invalid pointer dereferences originating from the t7xx WWAN driver.

  • t7xx_ccmni_recv_skb
  • ccmni_inst
  • DPMAIF PIT header index out of range
  • netif index 21-31

What your security team should do

  • Patch Linux kernels containing the t7xx driver to the fixed version
  • Monitor kernel logs for oops/panics referencing t7xx_ccmni_recv_skb
  • Limit exposure of t7xx WWAN interfaces to untrusted control planes where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() The netif index carried in the DPMAIF PIT header is five bits wide, but ccmni_inst[] only has room for NIC_DEV_MAX (21) entries. t7xx_ccmni_recv_skb() indexes the array without a bounds check, so indexes 21 to 31 read past it. The out-of-bounds value lands in the callback table that follows the array, which is never NULL, so the existing !ccmni check does not catch it and the driver dereferences whatever sits there as a struct t7xx_ccmni. Drop the skb when the index is out of range. Verified in a QEMU guest with a fault injector setting the netif index to 25: the unpatched driver reads a value past ccmni_inst[], which lands in the callback table, and dereferences it far enough to queue the skb. With this check the packet is dropped. Well-formed traffic on index 0 is unaffected. Changes in v2: none.

Affected packages

Ecosystem Package Introduced Fixed