Out-of-bounds read in Linux kernel - CVE-2026-98238

Vulnerability details

The vulnerability allows a local user to cause an out-of-bounds read and invalid pointer dereference.

The vulnerability exists due to an out-of-bounds read in t7xx_ccmni_recv_skb() when processing a DPMAIF PIT header containing an unchecked netif index. A local user can set the netif index to a value between 21 and 31 to cause an out-of-bounds read and invalid pointer dereference.

The out-of-bounds array access reaches an adjacent callback table containing non-null values, which are subsequently interpreted as pointers to struct t7xx_ccmni.

Affected software

How to mitigate CVE-2026-98238

External References

• https://git.kernel.org/stable/c/7c2fe308bda5a7e6222d7f0c3c311991372baab4
• https://git.kernel.org/stable/c/9dbf13de4edff6fbc1f7ad9c4040326b6ed599ad
• https://git.kernel.org/stable/c/c7ead9704249d57d4693a04697e3bbd285138fa9
• https://git.kernel.org/stable/c/d28aa2de9654e8024922775520a2665e00c04ad5
• https://git.kernel.org/stable/c/e1b0609b1a40da03e385be290853a604eb4c3fb9
• https://git.kernel.org/stable/c/fba45070e25abdae08bcaebfadeef050dc39e208

Related Security Bulletins

• Out-of-bounds read in Linux kernel wwan t7xx driver
• Debian update for linux