CVE-2026-98236net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
- —Not scoredno CVSS score yet
- 0.17%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value mhi_mbim_rx() ignores the return value of skb_copy_bits() when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie within the NTB itself, so a modem can point a datagram outside the received skb. The copy then fails and the freshly allocated skbn is passed to netif_rx() with its uninitialized contents still in place, leaking kernel heap memory into the network stack. Free the skb and account an error when the copy fails. Verified in a QEMU guest with a fault injector pointing a DPE outside the received NTB: the copy fails, and the unpatched driver hands the uninitialized skbn to the network stack (observed as "unknown protocol" on bytes that were never written). With this check the failed datagram is dropped and counted as an rx error. Changes in v2: factor the free-and-count sequence out into mhi_mbim_rx_drop(), shared with the unknown-protocol path, as suggested by Loic Poulain.
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 13 days later
· 13 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.17% · top 93% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected aa730a9905b7b079ef2fffdab7f15dbb842f5c7c – < 650af68435eaee783824457d2ef78cc5c03c1e88
- affected aa730a9905b7b079ef2fffdab7f15dbb842f5c7c – < 350fd3125ee26b5243935fd9e2b4d162ffba430a
- affected aa730a9905b7b079ef2fffdab7f15dbb842f5c7c – < dd136f1fdd1059f3bc25ede3a8def8f0ee151ce7
- affected aa730a9905b7b079ef2fffdab7f15dbb842f5c7c – < 298659c3677bf622afa9d77549cb4a967f9541e9
- affected aa730a9905b7b079ef2fffdab7f15dbb842f5c7c – < 02eba5f36d20283f144f75d47f0354a85e4f78f0
- affected aa730a9905b7b079ef2fffdab7f15dbb842f5c7c – < 7e98216e9da08b79e07a514d2a4f7646f8c9ccb9
- affected aa730a9905b7b079ef2fffdab7f15dbb842f5c7c – < 31550d585589fde1ae95bf7f7a8188b2d2fdf1c7
- affected 5.15
- unaffected < 5.15
- unaffected 5.15.222 – ≤ 5.15.*
- unaffected 6.1.189 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.112 – ≤ 6.12.*
- unaffected 6.18.54 – ≤ 6.18.*
- unaffected 7.2.8 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References7
- https://git.kernel.org/stable/c/650af68435eaee783824457d2ef78cc5c03c1e88 (opens in a new tab)
- https://git.kernel.org/stable/c/350fd3125ee26b5243935fd9e2b4d162ffba430a (opens in a new tab)
- https://git.kernel.org/stable/c/dd136f1fdd1059f3bc25ede3a8def8f0ee151ce7 (opens in a new tab)
- https://git.kernel.org/stable/c/298659c3677bf622afa9d77549cb4a967f9541e9 (opens in a new tab)
- https://git.kernel.org/stable/c/02eba5f36d20283f144f75d47f0354a85e4f78f0 (opens in a new tab)
- https://git.kernel.org/stable/c/7e98216e9da08b79e07a514d2a4f7646f8c9ccb9 (opens in a new tab)
- https://git.kernel.org/stable/c/31550d585589fde1ae95bf7f7a8188b2d2fdf1c7 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-93164 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98236)Record last updated .