Out-of-Bounds Read Vulnerability in Linux Kernel Affecting Modem Communication

CVE-2026-43495

What is CVE-2026-43495?

A vulnerability in the Linux kernel's handling of modem messages could lead to an out-of-bounds read, potentially exposing sensitive information or leading to system instability. Specifically, the issue occurs in the t7xx_port_enum_msg_handler function, where the modem-supplied port_count value is used as a loop limit without adequate validation. This flaw allows a malicious modem to send an excessively large port_count value within a smaller-than-required message buffer, triggering significant memory access errors. To mitigate this issue, robustness checks have been integrated, ensuring that message sizes are validated before processing, thereby preventing unauthorized memory access and improving overall system security.

References