FKIE_CVE-2026-72029
Vulnerability from fkie_nvd - Published: 2026-08-15 06:21 - Updated: 2026-08-17 06:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: wwan: iosm: bound device offsets in the MUX downlink decoder
mux_dl_adb_decode() walks a chain of aggregated datagram tables using
offsets and lengths taken from the modem. first_table_index,
next_table_index, table_length, datagram_index and datagram_length are
all device supplied le values. Only first_table_index was checked, and
only for being non zero. The decoder then formed adth = block +
adth_index and read the table header and the datagram entries with no
bound against the received skb. A modem that reports an index or a
length past the downlink buffer makes the decoder read out of bounds.
The buffer is IPC_MEM_MAX_DL_MUX_LITE_BUF_SIZE and skb->len is at most
that, so skb->len is the real limit, but none of these in band offsets
were checked against it.
The table chain is also followed with no forward progress check. The loop
takes the next table from adth->next_table_index and stops only when that
reaches zero. A modem can stage two tables that point at each other, so
the loop never ends. It runs in softirq and clones the skb on every pass.
Validate every device offset and length against skb->len before use.
The block header must fit. Each table header, on entry and after every
next_table_index, must lie inside the skb. The datagram table must fit.
Each datagram index and length must stay inside the skb. The header
padding must not exceed the datagram length so the receive length does
not wrap. Require each next_table_index to move forward so the chain
cannot cycle.
This was reproduced under KASAN as a slab out of bounds read on a normal
downlink receive once the iosm net device is up.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wwan/iosm/iosm_ipc_mux_codec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "155851e501d6c649cbcfcca6472dc26269b04b6b",
"status": "affected",
"version": "1f52d7b622854b8bd7a1be3de095ca2e1f77098e",
"versionType": "git"
},
{
"lessThan": "2b822df8e498aa6ca828e16afd8ffec27f7e4c88",
"status": "affected",
"version": "1f52d7b622854b8bd7a1be3de095ca2e1f77098e",
"versionType": "git"
},
{
"lessThan": "55cfea8e8d9117ad086d1e1a0ff87f306f8e3ad0",
"status": "affected",
"version": "1f52d7b622854b8bd7a1be3de095ca2e1f77098e",
"versionType": "git"
},
{
"lessThan": "07f5eb6d268a37bd9e131079489655cd599182e0",
"status": "affected",
"version": "1f52d7b622854b8bd7a1be3de095ca2e1f77098e",
"versionType": "git"
},
{
"lessThan": "77f0023f22f6a2616ae128e9c93961b24ae52611",
"status": "affected",
"version": "1f52d7b622854b8bd7a1be3de095ca2e1f77098e",
"versionType": "git"
},
{
"lessThan": "526b8ef54668780c8f69e0211c342763d5dcbad1",
"status": "affected",
"version": "1f52d7b622854b8bd7a1be3de095ca2e1f77098e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wwan/iosm/iosm_ipc_mux_codec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: iosm: bound device offsets in the MUX downlink decoder\n\nmux_dl_adb_decode() walks a chain of aggregated datagram tables using\noffsets and lengths taken from the modem. first_table_index,\nnext_table_index, table_length, datagram_index and datagram_length are\nall device supplied le values. Only first_table_index was checked, and\nonly for being non zero. The decoder then formed adth = block +\nadth_index and read the table header and the datagram entries with no\nbound against the received skb. A modem that reports an index or a\nlength past the downlink buffer makes the decoder read out of bounds.\n\nThe buffer is IPC_MEM_MAX_DL_MUX_LITE_BUF_SIZE and skb-\u003elen is at most\nthat, so skb-\u003elen is the real limit, but none of these in band offsets\nwere checked against it.\n\nThe table chain is also followed with no forward progress check. The loop\ntakes the next table from adth-\u003enext_table_index and stops only when that\nreaches zero. A modem can stage two tables that point at each other, so\nthe loop never ends. It runs in softirq and clones the skb on every pass.\n\nValidate every device offset and length against skb-\u003elen before use.\nThe block header must fit. Each table header, on entry and after every\nnext_table_index, must lie inside the skb. The datagram table must fit.\nEach datagram index and length must stay inside the skb. The header\npadding must not exceed the datagram length so the receive length does\nnot wrap. Require each next_table_index to move forward so the chain\ncannot cycle.\n\nThis was reproduced under KASAN as a slab out of bounds read on a normal\ndownlink receive once the iosm net device is up."
}
],
"id": "CVE-2026-72029",
"lastModified": "2026-08-17T06:18:00.630",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-08-15T06:21:02.083",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/07f5eb6d268a37bd9e131079489655cd599182e0"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/155851e501d6c649cbcfcca6472dc26269b04b6b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/2b822df8e498aa6ca828e16afd8ffec27f7e4c88"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/526b8ef54668780c8f69e0211c342763d5dcbad1"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/55cfea8e8d9117ad086d1e1a0ff87f306f8e3ad0"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/77f0023f22f6a2616ae128e9c93961b24ae52611"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…