VulnerabilityPublished 6 Oct 2026Updated 19 Oct 2026

CVE-2026-98238: Linux kernel · net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in fba45070e25abdae08bcaebfadeef050dc39e208 : patch Linux kernel soon.

Data as of 26 Oct 2026, 14:05 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in fba45070e25abdae08bcaebfadeef050dc39e208, e1b0609b1a40da03e385be290853a604eb4c3fb9, d28aa2de9654e8024922775520a2665e00c04ad5 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 05d19bf500f8281f574713479b04679fa226d0a3, < fba45070e25abdae08bcaebfadeef050dc39e208	Fixed in fba45070e25abdae08bcaebfadeef050dc39e208
LinuxLinux	Affected ≥ 05d19bf500f8281f574713479b04679fa226d0a3, < e1b0609b1a40da03e385be290853a604eb4c3fb9	Fixed in e1b0609b1a40da03e385be290853a604eb4c3fb9
LinuxLinux	Affected ≥ 05d19bf500f8281f574713479b04679fa226d0a3, < d28aa2de9654e8024922775520a2665e00c04ad5	Fixed in d28aa2de9654e8024922775520a2665e00c04ad5
LinuxLinux	Affected ≥ 05d19bf500f8281f574713479b04679fa226d0a3, < c7ead9704249d57d4693a04697e3bbd285138fa9	Fixed in c7ead9704249d57d4693a04697e3bbd285138fa9
LinuxLinux	Affected ≥ 05d19bf500f8281f574713479b04679fa226d0a3, < 9dbf13de4edff6fbc1f7ad9c4040326b6ed599ad	Fixed in 9dbf13de4edff6fbc1f7ad9c4040326b6ed599ad
LinuxLinux	Affected ≥ 05d19bf500f8281f574713479b04679fa226d0a3, < 7c2fe308bda5a7e6222d7f0c3c311991372baab4	Fixed in 7c2fe308bda5a7e6222d7f0c3c311991372baab4

AI-suggested

A fix is available and has been applied in the Linux kernel. The patch adds bounds checking on the netif index in t7xx_ccmni_recv_skb() to drop packets with invalid indexes. Users should update to a fixed kernel version to mitigate this vulnerability.

Description

A vulnerability in the Linux kernel's wwan t7xx driver allows out-of-bounds array access due to missing bounds checking on the netif index in the t7xx_ccmni_recv_skb() function. The netif index is five bits wide but the array ccmni_inst[] only supports 21 entries, leading to potential invalid memory dereference. This flaw is fixed by dropping packets with out-of-range indexes.

Impact

Out-of-bounds array access can lead to dereferencing invalid memory, which may cause kernel crashes or undefined behavior. The vulnerability could be exploited by crafted network packets to disrupt kernel operations or potentially escalate privileges, although no exploits in the wild are known. Normal traffic is unaffected by the fix.

Summary

The Linux kernel's wwan t7xx driver has a vulnerability where the netif index extracted from the DPMAIF PIT header is used to index the ccmni_inst[] array without bounds checking. Since the netif index can be up to 31 but the array only has 21 entries, indexes from 21 to 31 cause out-of-bounds reads into the callback table, which is non-NULL, leading to dereferencing invalid memory as a struct t7xx_ccmni. This can cause undefined behavior or potential memory corruption. The fix involves validating the netif index and dropping the skb if the index is out of range. This vulnerability was verified using a fault injector in a QEMU guest. Well-formed traffic with valid indexes is unaffected.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 12:08 UTC

Technical details

References

Community reviews

Related threats