CVE-2026-15461: Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input
The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/) embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper (drivers/gnss/gnssnmea0183match.c) requires that context to be the first member because its callbacks cast userdata directly to struct gnssnmea0183matchdata . In the affected releases matchdata was the second member (after const struct device dev), so it sat at a non-zero offset while gnssnmea0183matchinit() initialized it at the correct address. The registered NMEA handlers instead pass the whole device data object (data->devices.gnss->data, offset 0), producing an offset-shifted type confusion between where state is initialized and where the parse callbacks read and write it.
When NMEA sentences from the GNSS receiver are parsed, the GGA/RMC callbacks write parsed fix data into the wrong location within the struct, and the GSV callback (gnssnmea0183matchgsvcallback, active under CONFIGGNSSSATELLITES) reads its satellites pointer and bound from the wrong offsets — non-pointer bytes of struct hl78xxgnssdata — and then writes parsed struct gnsssatellite entries through that bogus pointer. This is a write through an uninitialized/wild pointer with a garbage bound.
The NMEA handlers are registered by default (CONFIGHL78XXGNSSSOURCENMEA is the default GNSS source) on devices using the HL78xx GNSS. The driver runs in kernel context and the NMEA data originates from the GNSS radio front-end, so a party able to influence the GNSS signal (for example GNSS/GPS spoofing at radio proximity) can drive the kernel-side parser into the faulty write. The most likely impact is a crash (denial of service) because the bogus pointer resolves to a fixed near-NULL value, with adjacent-memory corruption possible on MMU-less targets. Confidentiality is not affected. Exploitation requires the satellites feature to be enabled and active, so attack complexity is high.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to the wild-pointer write path?
Systems using the Sierra Wireless HL78xx modem GNSS driver are exposed when they parse NMEA input from the GNSS receiver. The satellite-processing path specifically requires CONFIG_GNSS_SATELLITES to be enabled.
What input is needed to trigger the issue?
The issue is reached when NMEA sentences from the GNSS receiver are parsed. GGA and RMC callbacks write fix data through the misaligned context, while GSV processing can read a satellites pointer and bound from incorrect struct offsets before writing through that pointer.
What can be checked to determine whether a build is affected?
Inspect the HL78xx GNSS driver data structure and its registered NMEA handlers. Affected code has gnss_nmea0183_match_data as a non-first member of struct hl78xx_gnss_data, but passes the enclosing device data object rather than the match_data member as callback user data.
Is there a configuration-dependent aspect to impact?
Yes. The GSV callback that interprets incorrect fields as a satellites pointer and bound is active only under CONFIG_GNSS_SATELLITES. The description also identifies GGA and RMC callback writes to incorrect locations during NMEA parsing.