CVE-2026-98236
net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
No known exploitation. EPSS puts it in the 7th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ aa730a9905b7b079ef2fffdab7f15dbb842f5c7c, < 650af68435eaee783824457d2ef78cc5c03c1e88Upgrade to: 650af68435eaee783824457d2ef78cc5c03c1e88Affected: ≥ aa730a9905b7b079ef2fffdab7f15dbb842f5c7c, < 350fd3125ee26b5243935fd9e2b4d162ffba430aUpgrade to: 350fd3125ee26b5243935fd9e2b4d162ffba430aAffected: ≥ aa730a9905b7b079ef2fffdab7f15dbb842f5c7c, < dd136f1fdd1059f3bc25ede3a8def8f0ee151ce7Upgrade to: dd136f1fdd1059f3bc25ede3a8def8f0ee151ce7Affected: ≥ aa730a9905b7b079ef2fffdab7f15dbb842f5c7c, < 298659c3677bf622afa9d77549cb4a967f9541e9Upgrade to: 298659c3677bf622afa9d77549cb4a967f9541e9 + 3 more branchesStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value mhi_mbim_rx() ignores the return value of skb_copy_bits() when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie within the NTB itself, so a modem can point a datagram outside the received skb. The copy then fails and the freshly allocated skbn is passed to netif_rx() with its uninitialized contents still in place, leaking kernel heap memory into the network stack. Free the skb and account an error when the copy fails. Verified in a QEMU guest with a fault injector pointing a DPE outside the received NTB: the copy fails, and the unpatched driver hands the uninitialized skbn to the network stack (observed as "unknown protocol" on bytes that were never written). With this check the failed datagram is dropped and counted as an rx error. Changes in v2: factor the free-and-count sequence out into mhi_mbim_rx_drop(), shared with the unknown-protocol path, as suggested by Loic Poulain.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 7th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/02eba5f36d20283f144f75d47f0354a85e4f78f0
- git.kernel.org/stable/c/298659c3677bf622afa9d77549cb4a967f9541e9
- git.kernel.org/stable/c/31550d585589fde1ae95bf7f7a8188b2d2fdf1c7
And 4 more references. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI