CVE-2026-43495

Vulnerability

The Linux kernel's t7xx WWAN driver contains an out-of-bounds read vulnerability in the t7xx_port_enum_msg_handler() function. When handling a port enumeration message from the modem, the function uses the modem-supplied port_count field as a loop bound over port_msg->data[] without verifying that the message buffer contains sufficient data. A modem can send a short message (e.g., 12 bytes) with port_count=65535, which causes a slab-out-of-bounds read of up to 262140 bytes. Additionally, in t7xx_parse_host_rt_data(), insufficient validation of feat_data_len can lead to out-of-bounds reads and signed integer overflow on offset calculations. The affected kernels are those prior to the commits that apply the fixes (see references [1], [2]).

Exploitation

An attacker must have control over the modem device connected to a system using the t7xx driver. No authentication or special privileges are required beyond physical or logical access to the modem. The attacker sends a crafted port enumeration message that specifies a large port_count value while the actual message buffer is small. The driver then iterates beyond the buffer bounds, reading memory that was not part of the intended data.

Impact

Successful exploitation results in a slab-out-of-bounds read, which can leak sensitive kernel memory contents to the attacker. This could lead to information disclosure of kernel addresses or other secrets. The vulnerability does not grant code execution directly, but the leaked information may aid further attacks.

Mitigation

Fix commits are available in the Linux kernel stable branches. Reference [1] (commit 0e7c074cfcd9) and reference [2] (commit 2b56d7903ab8) address the issue by adding appropriate buffer-length checks. Users should update to kernel versions containing these fixes. No CISA KEV listing has been issued at the time of writing.