The Linux kernel vulnerability CVE-2026-43495 involves the t7xx_port_enum_msg_handler function in the net: wwan: t7xx driver, which used the modem-supplied port_count as a loop bound without verifying that the message buffer contained sufficient data. This flaw allowed a specially crafted message with an excessively large port_count value to trigger a slab-out-of-bounds read of up to 262140 bytes. The fix involved adding checks for the size of the port message header and validating port_count against the actual message length before looping. Additional checks were added in t7xx_parse_host_rt_data() to prevent out-of-bounds reads and signed integer overflows. The vulnerability affects multiple Linux kernel versions prior to 6.8.0-1064.72 and related variants. The issue is tracked under CVE-2026-43495 and has a CVSS 3.1 score of 8.8, indicating high severity. A patch is available from the vendor, and users are advised to update to fixed kernel versions.

Successful exploitation of this vulnerability could lead to out-of-bounds memory reads in the kernel, potentially causing system instability or information disclosure. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability. The vulnerability does not require user interaction and has low attack complexity but requires adjacent network access. No known exploits in the wild have been reported at this time.

A vendor-provided patch is available and should be applied promptly. The Ubuntu security advisories USN-8566-1 and USN-8568-1 provide updated kernel package versions that address this and other vulnerabilities. After applying the update, a system reboot is required to activate the fixes. Due to ABI changes, recompilation and reinstallation of third-party kernel modules may be necessary. Users should follow the vendor's update instructions carefully. No additional mitigation steps are indicated by the vendor advisory.