CVE-2026-98238: net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
In the Linux kernel, the following vulnerability has been resolved:
net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb()
The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst[] only has room for NICDEVMAX (21) entries. t7xxccmnirecvskb() indexes the array without a bounds check, so indexes 21 to 31 read past it. The out-of-bounds value lands in the callback table that follows the array, which is never NULL, so the existing !ccmni check does not catch it and the driver dereferences whatever sits there as a struct t7xxccmni.
Drop the skb when the index is out of range.
Verified in a QEMU guest with a fault injector setting the netif index to 25: the unpatched driver reads a value past ccmniinst[], which lands in the callback table, and dereferences it far enough to queue the skb. With this check the packet is dropped. Well-formed traffic on index 0 is unaffected.
Changes in v2: none.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.189 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8 - Compensating control
In t7xx_ccmni_recv_skb(), validate the DPMAIF PIT netif index before indexing ccmni_inst[] and drop the skb when the index is out of range; indexes 21 to 31 are invalid because ccmni_inst[] has 21 entries.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel t7xx WWAN driver are exposed when they process DPMAIF packets carrying a netif index from 21 through 31. The issue is in t7xx_ccmni_recv_skb(), where those five-bit index values exceed the 21-entry ccmni_inst[] array.
What does an attacker need to trigger the flaw?
The attacker needs to cause the driver to receive a DPMAIF PIT header with an out-of-range netif index. A fault-injection test using index 25 reproduced the out-of-bounds array read and subsequent dereference.
Are normal valid packets affected?
Well-formed traffic using netif index 0 is unaffected. The vulnerable behavior occurs when the received index is outside the valid ccmni_inst[] range.
What mitigation is available before updating?
The described fix drops the skb when the netif index is out of range. No separate configuration workaround is provided in the available data.