The Linux kernel iosm network driver’s mux_dl_adb_decode() function processes a chain of aggregated datagram tables using offsets and lengths provided by the modem. These values—first_table_index, next_table_index, table_length, datagram_index, and datagram_length—were not properly validated against the skb buffer length, except for a minimal check on first_table_index being non-zero. This allowed the decoder to read out of bounds if the modem reported indices or lengths beyond the downlink buffer size. Additionally, the function followed the table chain without ensuring forward progress, allowing a crafted modem to create a cycle between two tables, causing an infinite loop in softirq context that clones the skb repeatedly. The vulnerability was reproduced under KASAN as a slab out-of-bounds read. The fix involves validating all device offsets and lengths against skb->len, ensuring headers and tables fit within the buffer, and requiring next_table_index to move forward to prevent cycles.

This vulnerability can lead to out-of-bounds memory reads in kernel space, which may cause system instability or crashes. The infinite loop condition in softirq context could lead to denial of service by exhausting system resources. No known exploits in the wild have been reported. The impact is limited to systems using the iosm network driver with vulnerable kernel versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the iosm network driver with untrusted modems that could supply malicious offsets or lengths. Monitor vendor channels for updates and apply patches promptly once released.