CVE-2026-98236 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
mhi_mbim_rx() ignores the return value of skb_copy_bits() when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie within the NTB itself, so a modem can point a datagram outside the received skb. The copy then fails and the freshly allocated skbn is passed to netif_rx() with its uninitialized contents still in place, leaking kernel heap memory into the network stack.
Free the skb and account an error when the copy fails.
Verified in a QEMU guest with a fault injector pointing a DPE outside the received NTB: the copy fails, and the unpatched driver hands the uninitialized skbn to the network stack (observed as "unknown protocol" on bytes that were never written). With this check the failed datagram is dropped and counted as an rx error.
Changes in v2: factor the free-and-count sequence out into mhi_mbim_rx_drop(), shared with the unknown-protocol path, as suggested by Loic Poulain.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified within the Linux kernel's Mobile High-definition Link (MHI) WWAN MBIM driver represents a critical information disclosure flaw rooted in improper input validation and error handling during network packet processing. The specific issue resides in the mhi_mbim_rx function, which is responsible for extracting datagrams from Non-Transparent Bridge (NTB) buffers to be passed up the networking stack via netif_rx. While the code performs a basic boundary check to ensure that the Datagram Packet Entry (DPE), which defines the offset and length of each datagram, lies within the bounds of the received NTB buffer, it fails to validate whether these parameters remain valid relative to the actual socket buffer (skb) structure after accounting for headers or other structural offsets. This oversight allows a maliciously crafted modem device to specify DPE values that point outside the allocated memory region of the skb, effectively creating an out-of-bounds read condition when the driver attempts to copy data from the NTB into a newly allocated skbn object.
The technical consequence of this flaw is severe due to how kernel memory management interacts with network subsystems. When the skb_copy_bits function detects that the requested offset and length exceed the available buffer space, it returns an error code indicating failure. However, the unpatched driver ignores this return value and proceeds to pass the freshly allocated skbn to netif_rx regardless of whether the copy operation succeeded or failed. Consequently, if the copy fails, the new socket buffer contains uninitialized kernel heap memory rather than valid network data. By injecting this uninitialized memory into the network stack, the vulnerability enables a local attacker with access to the WWAN interface, such as through a compromised modem device connected via USB or PCIe NTB, to leak sensitive kernel heap contents to user space or other processes that process these packets. This constitutes an information leakage vulnerability where internal kernel state can be exposed, potentially aiding further exploitation attempts by revealing pointers, cryptographic keys, or other confidential data stored in the heap.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-94 Information Exposure Through Kernel Memory Leak. The failure to check the return value of a critical memory operation is also characteristic of CWE-252 unchecked Return Value vulnerabilities. In terms of attack vectors, this falls under ATT&CK technique T1083 File and Directory Discovery or more specifically data exfiltration via local access if an attacker can control the modem input stream. The operational impact includes potential compromise of system confidentiality and integrity, as well as possible denial of service if the uninitialized memory causes downstream protocol handlers to crash when encountering invalid packet structures, such as unknown protocols resulting from garbage data being interpreted as valid headers.
Mitigation for this vulnerability requires strict adherence to defensive programming practices within kernel drivers handling external hardware inputs. The primary fix involves verifying the return value of skb_copy_bits and ensuring that any operation failing due to buffer boundary violations results in immediate resource cleanup rather than propagation of invalid state. Specifically, the driver must free the allocated skbn using kfree_skb or equivalent mechanisms when a copy failure occurs, preventing the uninitialized memory from reaching higher-level network protocols. Additionally, error counters should be incremented to track such failures for monitoring and debugging purposes. System administrators relying on affected kernel versions should apply vendor-provided security patches that include this validation logic. Developers implementing similar drivers must ensure that all data extracted from external hardware buffers is validated against both the source buffer boundaries and the destination allocation size before any copy operations are attempted, thereby eliminating the possibility of leaking uninitialized heap memory into the network stack.