Executive brief
A vulnerability in the Linux kernel's USB network driver could allow a remote attacker to crash systems using specific mobile broadband hardware. The issue occurs when the system processes certain types of internet traffic (IPsec) over a QMI-based cellular connection, leading to a complete system failure or 'kernel panic.' This primarily affects ARM-based devices, such as specialized networking equipment or embedded systems, potentially causing service outages.
Technical details
A vulnerability exists in the qmi_wwan driver within the Linux kernel's networking subsystem. The root cause is the failure to initialize the 'skb->mac_header' offset in the 'qmimux_rx_fixup' function. Because raw IP packets lack a MAC header, this uninitialized value triggers a kernel panic on ARM64 platforms due to strict alignment checks when accessed by the xfrm (IPsec) subsystem or other network layers. An attacker could potentially trigger this crash by sending specific network traffic to a vulnerable device. The issue has been resolved by ensuring the MAC header is reset during packet processing.
Affected products
- Linux Linux 4.12 to 6.12.34
Timeline
- 2025-10-29: other: Patch submitted by developer
- 2025-12-16: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0aabccdcec1f4a36f95829ea2263f845bbc77223
- https://git.kernel.org/stable/c/4e6b9004f01d0fef5b19778399bc5bf55f8c2d71
- https://git.kernel.org/stable/c/8ab3b8f958d861a7f725a5be60769106509fbd69
- https://git.kernel.org/stable/c/ae811175cea35b03ac6d7c910f43a82a43b9c3b3
- https://git.kernel.org/stable/c/bf527b80b80a282ab5bf1540546211fc35e5cd42
- https://git.kernel.org/stable/c/d693c47fb902b988f5752182e4f7fbde5e6dcaf9
- https://git.kernel.org/stable/c/dd03780c29f87c26c0e0bb7e0db528c8109461fb