Executive brief
A vulnerability exists in the Linux kernel's CAIF protocol implementation, which is used for communication between cellular modems and host processors. An attacker on the same local network or link could send specially crafted packets to crash the system or potentially access sensitive information stored in system memory. This issue primarily impacts the stability and data privacy of devices using this specific networking protocol.
Technical details
An integer underflow exists in the cffrml_receive() function within net/caif/cffrml.c of the Linux kernel. The vulnerability occurs when the Frame Check Sequence (FCS) is disabled; the code subtracts 2 from the packet's length field without verifying that the length is at least 2. An attacker can trigger this by sending a packet with a length field of 0 or 1, resulting in a large unsigned integer value. This leads to out-of-bounds operations, potential memory exhaustion, and the disclosure of uninitialized kernel memory. The issue has been patched in various stable branches including 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3.
Affected products
- Linux Linux Kernel 2.6.35 through 6.13-rc2
Timeline
- 2025-12-04: other: Patch authored
- 2026-01-02: patched: Patch committed to stable tree
- 2026-01-13: disclosed: CVE published
References
- https://git.kernel.org/stable/c/21fdcc00656a60af3c7aae2dea8dd96abd35519c
- https://git.kernel.org/stable/c/4ec29714aa4e0601ea29d2f02b461fc0ac92c2c3
- https://git.kernel.org/stable/c/785c7be6361630070790f6235b696da156ac71b3
- https://git.kernel.org/stable/c/8a11ff0948b5ad09b71896b7ccc850625f9878d1
- https://git.kernel.org/stable/c/c54091eec6fed19e94182aa05dd6846600a642f7
- https://git.kernel.org/stable/c/f407f1c9f45bbf5c99fd80b3f3f4a94fdbe35691
- https://git.kernel.org/stable/c/f818cd472565f8b0c2c409b040e0121c5cf8592c