{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-43495","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-05-01T14:12:56.013Z","datePublished":"2026-05-21T12:12:45.988Z","dateUpdated":"2026-08-05T12:28:18.825Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:28:18.825Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler\n\nt7xx_port_enum_msg_handler() uses the modem-supplied port_count field as\na loop bound over port_msg->data[] without checking that the message buffer\ncontains sufficient data. A modem sending port_count=65535 in a 12-byte\nbuffer triggers a slab-out-of-bounds read of up to 262140 bytes.\n\nAdd a sizeof(*port_msg) check before accessing the port message header\nfields to guard against undersized messages.\n\nAdd a struct_size() check after extracting port_count and before the loop.\n\nIn t7xx_parse_host_rt_data(), guard the rt_feature header read with a\nremaining-buffer check before accessing data_len, validate feat_data_len\nagainst the actual remaining buffer to prevent OOB reads and signed\ninteger overflow on offset.\n\nPass msg_len from both call sites: skb->len at the DPMAIF path after\nskb_pull(), and the validated feat_data_len at the handshake path."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable parser consumes control messages supplied by the cellular modem/baseband over PCIe; the realistic worst-case attacker is a rogue base station / over-the-air baseband compromise that pivots to the host kernel, which is the cellular-radio analog of WiFi/Bluetooth adjacency. It is not directly Network-reachable because these are internal AP↔modem control messages, not internet-routable packets.\nAC:L - A malicious/compromised modem reliably triggers the OOB read by setting port_count to a large value (up to 65535) in an undersized buffer; there is no race or attacker-uncontrollable precondition, and the ~256 KB read reliably reaches unmapped memory.\nPR:N - The modem's messages are parsed automatically during the handshake/port-enumeration with no authentication or privilege check on the device-supplied data, so the attacker needs no host-side credentials.\nUI:N - Port enumeration and runtime-feature handshake are processed automatically by kernel threads at modem init and runtime; no user action is required.\nS:U - The vulnerable code and the impacted resource are both the host kernel; there is no crossing into a different security authority such as a VM/hypervisor or IOMMU domain.\nC:H - The flaw is a large slab-out-of-bounds read of up to ~256 KB of adjacent kernel heap, and the read values steer channel enable/disable behavior, providing a disclosure oracle — well above a few bounded bytes.\nI:H - The out-of-bounds data is interpreted as port_info and drives kernel driver channel enable/disable state, modifying kernel-internal state based on attacker-influenced out-of-bounds memory; rounding up under uncertainty.\nA:H - An out-of-bounds read of up to ~256 KB past a 12-byte slab object reliably crosses into unmapped/poisoned pages, causing a kernel oops/panic (denial of service)."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wwan/t7xx/t7xx_modem_ops.c","drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c","drivers/net/wwan/t7xx/t7xx_port_proxy.h"],"versions":[{"version":"da45d2566a1d4e260b894ff5d96be64b21c7fa79","lessThan":"307c5d0f36a5c74042217136da5bfbd9f7504650","status":"affected","versionType":"git"},{"version":"da45d2566a1d4e260b894ff5d96be64b21c7fa79","lessThan":"f94450ce5053b36002995b72d1fa1db3bb08c5bf","status":"affected","versionType":"git"},{"version":"da45d2566a1d4e260b894ff5d96be64b21c7fa79","lessThan":"9855e063e063158cc5bded576382599dc3133202","status":"affected","versionType":"git"},{"version":"da45d2566a1d4e260b894ff5d96be64b21c7fa79","lessThan":"2b56d7903ab804481f5233a259d5f341e9fd513c","status":"affected","versionType":"git"},{"version":"da45d2566a1d4e260b894ff5d96be64b21c7fa79","lessThan":"dd4f4c93c1488d7100b9964f2da4c8b3c29652f1","status":"affected","versionType":"git"},{"version":"da45d2566a1d4e260b894ff5d96be64b21c7fa79","lessThan":"0e7c074cfcd9bd93765505f9eb8b42f03ed2a744","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/wwan/t7xx/t7xx_modem_ops.c","drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c","drivers/net/wwan/t7xx/t7xx_port_proxy.h"],"versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","status":"unaffected","versionType":"semver"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.140","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.88","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.30","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.7","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.6.140"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.12.88"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.18.30"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"7.0.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/307c5d0f36a5c74042217136da5bfbd9f7504650"},{"url":"https://git.kernel.org/stable/c/f94450ce5053b36002995b72d1fa1db3bb08c5bf"},{"url":"https://git.kernel.org/stable/c/9855e063e063158cc5bded576382599dc3133202"},{"url":"https://git.kernel.org/stable/c/2b56d7903ab804481f5233a259d5f341e9fd513c"},{"url":"https://git.kernel.org/stable/c/dd4f4c93c1488d7100b9964f2da4c8b3c29652f1"},{"url":"https://git.kernel.org/stable/c/0e7c074cfcd9bd93765505f9eb8b42f03ed2a744"}],"title":"net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/06/18/1"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-06-18T18:47:33.811Z"}}]}}