Out-of-bounds read in Linux kernel - CVE-2026-72029
Published: August 16, 2026
Vulnerability details
The vulnerability allows a local attacker to disclose sensitive information and cause a denial of service.
The vulnerability exists due to an out-of-bounds read and improper validation of device-supplied offsets and lengths in mux_dl_adb_decode() in the iosm MUX downlink decoder when processing modem-supplied aggregated datagram tables in a received skb. A local attacker can provide crafted offset and length values to trigger out-of-bounds reads and an infinite loop to disclose sensitive information and cause a denial of service.
The issue can be triggered by a modem that supplies malformed table and datagram metadata after the iosm net device is up, and the loop runs in softirq while cloning the skb on each pass.
Affected software
How to mitigate CVE-2026-72029
External References
- https://git.kernel.org/stable/c/07f5eb6d268a37bd9e131079489655cd599182e0
- https://git.kernel.org/stable/c/155851e501d6c649cbcfcca6472dc26269b04b6b
- https://git.kernel.org/stable/c/2b822df8e498aa6ca828e16afd8ffec27f7e4c88
- https://git.kernel.org/stable/c/526b8ef54668780c8f69e0211c342763d5dcbad1
- https://git.kernel.org/stable/c/55cfea8e8d9117ad086d1e1a0ff87f306f8e3ad0
- https://git.kernel.org/stable/c/77f0023f22f6a2616ae128e9c93961b24ae52611