CVE-2026-98237 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
The NDP traversal in mhi_mbim_rx() only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP, keeps the loop spinning forever on one CPU.
Break out when the next NDP offset is not larger than the current one.
Verified in a QEMU guest with a fault injector feeding the driver's receive callback an NTB whose single NDP points at itself: the unpatched driver spins in mhi_mbim_rx() with one CPU pinned at 100% and the thread never returns. With this check the loop terminates within one iteration.
Changes in v2: move the non-increasing check to the wNextNdpIndex retrieval site, as suggested by Loic Poulain, instead of tracking the previous offset in a separate variable.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel network subsystem contains a critical flaw within the Mobile High-Definition Interface WWAN MBIM driver that allows for an infinite loop condition triggered by malformed Network Data Packet chains. This vulnerability resides specifically in the mhi_mbim_rx function, which is responsible for processing incoming data from modem devices using the MHI transport protocol and MBIM encapsulation. The core issue stems from a lack of bounds checking on the traversal logic used to iterate through Next Descriptor Pointers within received network buffers. Under normal operation, this loop processes each NDP by following pointers until it encounters an index value indicating no further descriptors exist. However, the implementation relies solely on detecting when wNextNdpIndex equals zero to terminate execution. It fails to validate whether the offset of the subsequent descriptor is strictly greater than that of the current one.
This design oversight creates a significant security risk because any modem device or simulated environment capable of injecting crafted network buffers can exploit this logic error. If a malicious actor controls the data stream, they can construct an NTB where the single NDP points to itself rather than advancing to a new memory location or terminating with zero. When such a packet is processed by the vulnerable driver, the traversal loop never encounters a non-zero termination condition nor does it detect that it has revisited a previous state. Consequently, the CPU core executing this kernel thread becomes pinned at one hundred percent utilization indefinitely. This results in a local denial of service where system resources are exhausted and normal operations on the affected host are severely degraded or halted entirely due to resource starvation caused by the spinning loop.
From a technical classification perspective, this vulnerability aligns with CWE-835, which describes loops that do not terminate correctly, often referred to as infinite loops or non-terminating iterations. The root cause is identified as CWE-20, Improper Input Validation, specifically regarding the failure to verify structural integrity and logical consistency of input data structures before processing them in a loop context. In terms of attack vectors, this flaw facilitates availability impacts consistent with MITRE ATT&CK technique T1499, Endpoint Denial of Service, where an attacker leverages software vulnerabilities to disrupt service on specific targets without necessarily gaining unauthorized access or executing arbitrary code. The exploitation requires the ability to inject network traffic into the WWAN interface, which may be possible in scenarios involving compromised modems, malicious USB devices emulating such hardware, or virtualized environments like QEMU where fault injection tools can simulate malformed packet streams.
The resolution involves modifying the traversal logic within mhi_mbim_rx to enforce a monotonic increase constraint on descriptor offsets. By checking if the next NDP offset is less than or equal to the current one before proceeding, the driver ensures that it does not enter cycles of self-referential pointers. This fix effectively prevents the infinite loop scenario by forcing an early exit when logical progression breaks down. To mitigate this risk in environments where kernel updates may be delayed, administrators should restrict physical access to WWAN interfaces and disable unnecessary network services if feasible. Furthermore, implementing strict input validation at the device driver level for all external data sources remains a fundamental security practice. Organizations relying on Linux-based systems with MHI WWAN support must apply the relevant kernel patch immediately to restore system stability and prevent potential denial of service attacks stemming from malformed network packet processing.