Executive brief
A vulnerability in the Linux kernel's t7xx WWAN driver could allow a malicious or compromised cellular modem to crash the system or access sensitive kernel memory. The driver, which manages communication with certain mobile broadband hardware, fails to properly verify the size of messages sent by the modem. This could lead to unauthorized data access or system instability for users of affected hardware.
Technical details
A slab-out-of-bounds read vulnerability exists in the Linux kernel t7xx WWAN driver within the t7xx_port_enum_msg_handler() and t7xx_parse_host_rt_data() functions. The root cause is the lack of validation for the 'port_count' and 'data_len' fields supplied by the modem hardware, which are used as loop bounds or offset increments. An attacker with control over the modem (e.g., via compromised firmware) can send a specially crafted message with a large port_count but a small buffer, triggering an out-of-bounds read of up to 262,140 bytes. This can result in the leakage of sensitive kernel memory or a system crash. Patches have been released to implement proper bounds checking using sizeof() and struct_size() before processing message headers and data.
Affected products
- Linux Linux Kernel t7xx driver versions prior to May 2026 patches
Timeline
- 2026-05-01: patched: Initial patch submitted by Pavitra Jha
- 2026-05-21: disclosed: CVE-2026-43495 published
References
- https://git.kernel.org/stable/c/0e7c074cfcd9bd93765505f9eb8b42f03ed2a744
- https://git.kernel.org/stable/c/2b56d7903ab804481f5233a259d5f341e9fd513c
- https://git.kernel.org/stable/c/9855e063e063158cc5bded576382599dc3133202
- https://git.kernel.org/stable/c/dd4f4c93c1488d7100b9964f2da4c8b3c29652f1
- https://git.kernel.org/stable/c/f94450ce5053b36002995b72d1fa1db3bb08c5bf