Executive brief
A vulnerability in the Linux kernel's Phonet networking protocol could allow a local user to crash the entire system. Phonet is a protocol used primarily for communication with cellular modems in certain mobile devices. By sending specific network messages that trigger an internal error during socket binding, an attacker can cause a kernel panic, leading to a complete service outage and requiring a system reboot.
Technical details
A vulnerability in `net/phonet/socket.c` exists due to an incorrect assumption in the `pn_socket_autobind()` function. The function incorrectly assumes that an `-EINVAL` error from `pn_socket_bind()` always implies the socket is already bound, subsequently triggering a `BUG_ON()` assertion if the port is zero. However, `pn_socket_bind()` can also return `-EINVAL` if the socket state is not `TCP_CLOSE`, even if it has never been bound. A local attacker can trigger this condition via `pn_socket_sendmsg()`, leading to a kernel panic (DoS). The fix involves properly checking the port status and propagating the error instead of asserting. Patches are available in stable branches including 5b0c911 and 6db58ee.
Affected products
- Linux Linux Kernel 2.6.28 to 7.0.10
Timeline
- 2026-04-23: other: Initial patch authored
- 2026-06-26: disclosed: CVE published