CVE-2026-98238

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() The netif index carried in the DPMAIF PIT header is five bits wide, but ccmni_inst[] only has room for NIC_DEV_MAX (21) entries. t7xx_ccmni_recv_skb() indexes the array without a bounds check, so indexes 21 to 31 read past it. The out-of-bounds value lands in the callback table that follows the array, which is never NULL, so the existing !ccmni check does not catch it and the driver dereferences whatever sits there as a struct t7xx_ccmni. Drop the skb when the index is out of range. Verified in a QEMU guest with a fault injector setting the netif index to 25: the unpatched driver reads a value past ccmni_inst[], which lands in the callback table, and dereferences it far enough to queue the skb. With this check the packet is dropped. Well-formed traffic on index 0 is unaffected. Changes in v2: none.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98238

EUVD

EUVD-2026-93166

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	05d19bf500f8281f574713479b04679fa226d0a3
Linux	Linux	05d19bf500f8281f574713479b04679fa226d0a3
Linux	Linux	05d19bf500f8281f574713479b04679fa226d0a3
Linux	Linux	05d19bf500f8281f574713479b04679fa226d0a3
Linux	Linux	05d19bf500f8281f574713479b04679fa226d0a3
Linux	Linux	05d19bf500f8281f574713479b04679fa226d0a3
Linux	Linux	5.19

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's wwan subsystem, specifically in the t7xx driver for certain modems. The issue occurs in the t7xx_ccmni_recv_skb() function where a network interface index from a packet header is used to access an array without checking if it is within valid bounds. The array only supports up to 21 entries, but the index can be up to 31, leading to out-of-bounds memory access. This could allow malicious packets to trigger unintended behavior in the driver.

Detection Guidance

This vulnerability affects the Linux kernel's t7xx driver for WWAN devices. Detection requires checking if the system uses the affected driver and kernel version. Inspect kernel logs for crashes or unusual behavior in the t7xx module. Commands like dmesg | grep t7xx or lsmod | grep t7xx may help identify the driver. No specific commands are provided in the context to directly detect exploitation.

Impact Analysis

An attacker could potentially send specially crafted network packets to a vulnerable system, causing the kernel to read or write memory outside the intended array bounds. This might lead to crashes, data corruption, or even arbitrary code execution with kernel privileges. Systems using the affected t7xx driver are at risk if they process untrusted network traffic.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel driver issue involving out-of-bounds array access in the Linux kernel's wwan subsystem, which could lead to memory corruption or crashes but does not involve data exposure or privacy violations typical of compliance concerns.

Mitigation Strategies

Apply the latest kernel update that includes the fix for CVE-2026-98238. If an update is not immediately available, disable the t7xx driver module (rmmod t7xx) if not required. Monitor network traffic for unusual patterns, especially on WWAN interfaces. Restrict access to WWAN devices if possible.

Hi! I’m here to help you understand CVE-2026-98238. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70