CVE-2026-23172 Overview
CVE-2026-23172 is a buffer overflow vulnerability in the Linux kernel's t7xx WWAN driver. The flaw resides in the t7xx_dpmaif_set_frag_to_skb() function within the DPMAIF receive path. The function adds page fragments to a socket buffer without verifying that nr_frags remains below MAX_SKB_FRAGS. A malicious, buggy, or compromised modem firmware can send packets with excessive fragments to overflow the skb_shinfo(skb)->frags[] array. The resulting memory corruption can crash the kernel or produce undefined behavior on affected systems.
Critical Impact
Local attackers leveraging compromised modem firmware can corrupt adjacent kernel memory, leading to denial of service through kernel panic on Linux systems using the t7xx WWAN driver.
Affected Products
- Linux Kernel versions prior to the fix commits
- Linux Kernel 6.19-rc1 through 6.19-rc7
- Systems using the MediaTek t7xx WWAN driver (DPMAIF interface)
Discovery Timeline
- 2026-02-14 - CVE-2026-23172 published to NVD
- 2026-04-03 - Last updated in NVD database
Technical Details for CVE-2026-23172
Vulnerability Analysis
The vulnerability exists in the Data Plane Modem AP Interface (DPMAIF) receive path of the MediaTek t7xx WWAN driver. The t7xx_dpmaif_set_frag_to_skb() function processes incoming network packets and attaches page fragments to socket buffers via skb_add_rx_frag(). The function does not validate the current fragment count against the kernel's MAX_SKB_FRAGS constant before adding new fragments. This omission allows writes beyond the bounds of the fixed-size frags[] array embedded in skb_shared_info.
The issue was identified through static code analysis. Researchers compared the t7xx driver against a similar flaw previously fixed in the mt76 Wi-Fi driver under commit b102f0c522cf. The bug class falls under [CWE-401] tracking and represents an array index out-of-bounds write in kernel memory.
Root Cause
The root cause is missing bounds validation on firmware-supplied fragment counts. Under normal protocol operation, an MTU of 3080 bytes combined with a BAT buffer of 3584 bytes ensures that a single packet does not require additional fragments. The driver implicitly trusts this protocol invariant. The kernel should not rely on firmware behavior to enforce safety boundaries on shared data structures.
Attack Vector
Exploitation requires either malicious modem firmware or a compromised firmware update path. An attacker who controls the modem can craft RX packets containing more fragments than MAX_SKB_FRAGS permits. Each excess fragment writes past the end of the frags[] array, corrupting adjacent skb_shared_info fields and surrounding kernel allocations. The vulnerability requires local access through the WWAN interface and produces high availability impact through kernel crashes.
The fix adds a bounds check before invoking skb_add_rx_frag(). The check must occur before DMA unmapping to prevent both page leaks and double DMA unmap operations during device teardown.
Detection Methods for CVE-2026-23172
Indicators of Compromise
- Unexpected kernel panics or oops messages referencing t7xx_dpmaif_set_frag_to_skb or skb_add_rx_frag in stack traces
- Kernel memory corruption warnings from KASAN reports involving skb_shared_info structures
- Abnormal WWAN device disconnects or DMA unmap warnings in dmesg output
Detection Strategies
- Audit running kernel versions against the patched commits 2a0522f564, 2c0fb0f60b, af4b8577d0, f0813bcd2d, and f9747a7521
- Monitor kernel logs for warnings tied to the t7xx driver module and DPMAIF subsystem
- Validate modem firmware integrity and signatures on devices using MediaTek WWAN modules
Monitoring Recommendations
- Forward dmesg and journald kernel logs to a centralized SIEM for anomaly correlation
- Alert on repeated WWAN interface resets or driver reinitialization events
- Track firmware update events on endpoints with WWAN modems to detect unauthorized changes
How to Mitigate CVE-2026-23172
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the vendor advisories
- Inventory all Linux endpoints and servers using the t7xx WWAN driver
- Restrict physical and administrative access to WWAN-equipped devices until patched
Patch Information
The Linux kernel maintainers released fixes across multiple stable branches. Patch commits include 2a0522f564acd34442652ea083091c329fa7c5d5, 2c0fb0f60bc1545c52da61bc6bd4855c1e7814ba, af4b8577d0b388cc3d0039eb0cdd9ca5bbbc9276, f0813bcd2d9d97fdbdf2efb9532ab03ae92e99e6, and f9747a7521a48afded5bff2faf1f2dcfff48c577. See the Kernel Git Commit 2a0522f564 and Kernel Git Commit f9747a7521 for technical details on the bounds check fix.
Workarounds
- Unload the t7xx kernel module on systems that do not require WWAN connectivity using modprobe -r t7xx
- Blacklist the t7xx driver in /etc/modprobe.d/ to prevent automatic loading at boot
- Enforce firmware verification policies to ensure only signed modem firmware loads on affected hardware
# Configuration example: blacklist the t7xx driver until patched
echo "blacklist t7xx" | sudo tee /etc/modprobe.d/blacklist-t7xx.conf
sudo modprobe -r t7xx
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
