Linux Kernel OOB Read in WWAN t7xx Port Enum Handler
CVE-2026-43495 Published on May 21, 2026
net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler
In the Linux kernel, the following vulnerability has been resolved:
net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler
t7xx_port_enum_msg_handler() uses the modem-supplied port_count field as
a loop bound over port_msg->data[] without checking that the message buffer
contains sufficient data. A modem sending port_count=65535 in a 12-byte
buffer triggers a slab-out-of-bounds read of up to 262140 bytes.
Add a sizeof(*port_msg) check before accessing the port message header
fields to guard against undersized messages.
Add a struct_size() check after extracting port_count and before the loop.
In t7xx_parse_host_rt_data(), guard the rt_feature header read with a
remaining-buffer check before accessing data_len, validate feat_data_len
against the actual remaining buffer to prevent OOB reads and signed
integer overflow on offset.
Pass msg_len from both call sites: skb->len at the DPMAIF path after
skb_pull(), and the validated feat_data_len at the handshake path.
Products Associated with CVE-2026-43495
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version da45d2566a1d4e260b894ff5d96be64b21c7fa79 and below f94450ce5053b36002995b72d1fa1db3bb08c5bf is affected.
- Version da45d2566a1d4e260b894ff5d96be64b21c7fa79 and below 9855e063e063158cc5bded576382599dc3133202 is affected.
- Version da45d2566a1d4e260b894ff5d96be64b21c7fa79 and below 2b56d7903ab804481f5233a259d5f341e9fd513c is affected.
- Version da45d2566a1d4e260b894ff5d96be64b21c7fa79 and below dd4f4c93c1488d7100b9964f2da4c8b3c29652f1 is affected.
- Version da45d2566a1d4e260b894ff5d96be64b21c7fa79 and below 0e7c074cfcd9bd93765505f9eb8b42f03ed2a744 is affected.
- Version 5.19 is affected.
- Before 5.19 is unaffected.
- Version 6.6.140, <= 6.6.* is unaffected.
- Version 6.12.88, <= 6.12.* is unaffected.
- Version 6.18.30, <= 6.18.* is unaffected.
- Version 7.0.7, <= 7.0.* is unaffected.
- Version 7.1-rc3, <= * is unaffected.