CVE-2026-98237
Description
A flaw was found in the Linux kernel's MHI Mobile Broadband Interface Model (MBIM) driver. This flaw allows a malicious or compromised modem to cause a Denial of Service (DoS) by sending network frames with cyclic Network Datagram Pointer (NDP) chains that do not advance. Processing these cyclic descriptors causes an infinite loop in the driver, pinning a CPU core at full capacity and hanging the receiving thread.
Statement
A low-impact denial of service flaw was found in the Linux kernel MHI WWAN MBIM driver (mhi_wwan_mbim). When the driver receives a Network Transfer Block (NTB), the NDP traversal loop in mhi_mbim_rx() only stops when the next NDP index is zero and does not verify that the offsets advance. A malicious or compromised modem can therefore deliver frames with a cyclic or self-referential Network Datagram Pointer (NDP) chain, driving the driver into an infinite loop that pins a CPU core at 100% and hangs the receive thread. Confidentiality and integrity are not affected.
Red Hat rates this flaw as low severity because the attack requires a malicious or compromised modem attached over the MHI bus; ordinary network traffic does not control the NDP metadata produced by modem firmware, so an arbitrary remote peer cannot trigger the loop.
The MHI MBIM driver is present in Red Hat Enterprise Linux 9 (from 9.3 onward), Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS 9 based OpenShift Container Platform releases (4.16 and later, including 5.x), which are affected. Fixes for these streams are currently deferred to a future update; the residual risk of deferral is limited to a local denial of service (CPU exhaustion on one core) that requires attacker-controlled modem hardware or firmware. Red Hat Enterprise Linux 6, 7, 8, and RHEL 9.2, as well as OpenShift Container Platform 4.15 and earlier (including the RHEL CoreOS 8 based releases), are not affected because the vulnerable driver code is not present in those versions.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
