CVE-2026-98237

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain The NDP traversal in mhi_mbim_rx() only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP, keeps the loop spinning forever on one CPU. Break out when the next NDP offset is not larger than the current one. Verified in a QEMU guest with a fault injector feeding the driver's receive callback an NTB whose single NDP points at itself: the unpatched driver spins in mhi_mbim_rx() with one CPU pinned at 100% and the thread never returns. With this check the loop terminates within one iteration. Changes in v2: move the non-increasing check to the wNextNdpIndex retrieval site, as suggested by Loic Poulain, instead of tracking the previous offset in a separate variable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98237

EUVD

EUVD-2026-93165

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	aa730a9905b7b079ef2fffdab7f15dbb842f5c7c
Linux	Linux	aa730a9905b7b079ef2fffdab7f15dbb842f5c7c
Linux	Linux	aa730a9905b7b079ef2fffdab7f15dbb842f5c7c
Linux	Linux	aa730a9905b7b079ef2fffdab7f15dbb842f5c7c
Linux	Linux	aa730a9905b7b079ef2fffdab7f15dbb842f5c7c
Linux	Linux	aa730a9905b7b079ef2fffdab7f15dbb842f5c7c
Linux	Linux	aa730a9905b7b079ef2fffdab7f15dbb842f5c7c
Linux	Linux	5.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a cyclic NDP chain in the mhi_wwan_mbim driver. The NDP traversal in mhi_mbim_rx() function only stops when wNextNdpIndex reaches zero, but a malicious modem could create a loop by pointing an NDP at itself or an earlier NDP. This causes the loop to spin indefinitely on one CPU, leading to a denial of service.

Detection Guidance

This vulnerability is specific to the Linux kernel's mhi_wwan_mbim driver and may cause CPU exhaustion due to an infinite loop in NDP chain traversal. Detection requires checking kernel logs for abnormal CPU usage or driver crashes. Monitor for processes stuck in mhi_mbim_rx() or high CPU load from wwan-related threads.

Impact Analysis

This vulnerability can cause a system to hang or become unresponsive due to an infinite loop in the kernel's network driver. It may lead to high CPU usage, system slowdowns, or complete denial of service on affected systems using the mhi_wwan_mbim driver.

Compliance Impact

This vulnerability causes a denial-of-service condition by causing a CPU to spin indefinitely at 100% usage, which could lead to system unavailability. For compliance standards like GDPR or HIPAA, which require availability and security of data processing systems, this could result in non-compliance due to prolonged downtime and potential data processing interruptions.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this issue. The patch adds a check to break the loop if the NDP offset does not increase. If immediate patching is not possible, disable the mhi_wwan_mbim driver or restrict modem functionality until the update is applied.

Hi! I’m here to help you understand CVE-2026-98237. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70