CVE-2026-23172: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23172 is a buffer overflow vulnerability in the Linux kernel's t7xx WWAN (Wireless Wide Area Network) driver affecting the DPMAIF RX path. The flaw exists in the t7xx_dpmaif_set_frag_to_skb() function, which adds page fragments to socket buffers (skbs) without checking whether the number of fragments exceeds MAX_SKB_FRAGS, potentially overflowing the skb_shinfo(skb)->frags[] array. It was published on February 14, 2026, and affects Linux kernel versions from 5.19 through multiple stable branches (before 6.1.162, 6.6.123, 6.12.69, and 6.18.9). The CVSS v3.1 base score is 5.5 (Medium), with a local attack vector requiring low privileges (Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), stemming from the absence of a bounds check before calling skb_add_rx_frag() in the DPMAIF RX path of the t7xx driver (net/wwan/t7xx). An attacker or malicious/buggy modem firmware can craft packets with more page fragments than MAX_SKB_FRAGS allows, causing an out-of-bounds write into the skb_shinfo(skb)->frags[] array and corrupting adjacent kernel memory. The bounds check must be performed before DMA unmapping to prevent a page leak and double DMA unmap during device teardown. This issue was identified through static code analysis, drawing parallels to a similar vulnerability fixed in the mt76 driver (commit b102f0c522cf). No public PoC exploit code has been identified (Feedly, kernel.org patch).

Successful exploitation can result in kernel memory corruption, leading to kernel crashes (denial of service), undefined behavior, or potentially more severe memory corruption primitives depending on what data occupies adjacent memory. The primary impact is availability (kernel panic/crash), though memory corruption could theoretically be leveraged for privilege escalation in a targeted attack scenario. The vulnerability is scoped to systems using MediaTek t7xx WWAN hardware (e.g., devices with T700/T750 modems), limiting the affected asset population (Feedly).

• Logs: Unexpected kernel panic or oops messages in /var/log/kern.log or dmesg output referencing t7xx, dpmaif, or skb_shinfo with array index out-of-bounds errors.
• Process/System: Sudden system reboots or kernel crashes on systems equipped with MediaTek t7xx WWAN modems, particularly during active data reception.
• File System: Kernel crash dump files (e.g., /var/crash/ or kdump artifacts) generated on systems with t7xx WWAN hardware.
• Network: Anomalous modem firmware behavior generating packets with an unusually high number of fragments, observable via modem diagnostic logs or WWAN interface statistics.

Update the Linux kernel to a patched stable version: 6.1.162 or later, 6.6.123 or later, 6.12.69 or later, or 6.18.9 or later, depending on the currently deployed kernel branch. Patch commits are available in the kernel.org stable repositories (kernel.org patch). As a workaround where patching is not immediately possible, ensure modem firmware is sourced only from trusted vendors and kept up to date to reduce the risk of malicious or buggy firmware triggering the overflow. Systems not using t7xx WWAN hardware are not affected and require no action (Feedly).