GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43495 (GCVE-0-2026-43495)

Vulnerability from cvelistv5 – Published: 2026-05-21 12:12 – Updated: 2026-08-05 12:28
VLAI
Title
net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler
Summary
In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler t7xx_port_enum_msg_handler() uses the modem-supplied port_count field as a loop bound over port_msg->data[] without checking that the message buffer contains sufficient data. A modem sending port_count=65535 in a 12-byte buffer triggers a slab-out-of-bounds read of up to 262140 bytes. Add a sizeof(*port_msg) check before accessing the port message header fields to guard against undersized messages. Add a struct_size() check after extracting port_count and before the loop. In t7xx_parse_host_rt_data(), guard the rt_feature header read with a remaining-buffer check before accessing data_len, validate feat_data_len against the actual remaining buffer to prevent OOB reads and signed integer overflow on offset. Pass msg_len from both call sites: skb->len at the DPMAIF path after skb_pull(), and the validated feat_data_len at the handshake path.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: da45d2566a1d4e260b894ff5d96be64b21c7fa79 , < 307c5d0f36a5c74042217136da5bfbd9f7504650 (git)
Affected: da45d2566a1d4e260b894ff5d96be64b21c7fa79 , < f94450ce5053b36002995b72d1fa1db3bb08c5bf (git)
Affected: da45d2566a1d4e260b894ff5d96be64b21c7fa79 , < 9855e063e063158cc5bded576382599dc3133202 (git)
Affected: da45d2566a1d4e260b894ff5d96be64b21c7fa79 , < 2b56d7903ab804481f5233a259d5f341e9fd513c (git)
Affected: da45d2566a1d4e260b894ff5d96be64b21c7fa79 , < dd4f4c93c1488d7100b9964f2da4c8b3c29652f1 (git)
Affected: da45d2566a1d4e260b894ff5d96be64b21c7fa79 , < 0e7c074cfcd9bd93765505f9eb8b42f03ed2a744 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.140 , ≤ 6.6.* (semver)
Unaffected: 6.12.88 , ≤ 6.12.* (semver)
Unaffected: 6.18.30 , ≤ 6.18.* (semver)
Unaffected: 7.0.7 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-18T18:47:33.811Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/18/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wwan/t7xx/t7xx_modem_ops.c",
            "drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c",
            "drivers/net/wwan/t7xx/t7xx_port_proxy.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "307c5d0f36a5c74042217136da5bfbd9f7504650",
              "status": "affected",
              "version": "da45d2566a1d4e260b894ff5d96be64b21c7fa79",
              "versionType": "git"
            },
            {
              "lessThan": "f94450ce5053b36002995b72d1fa1db3bb08c5bf",
              "status": "affected",
              "version": "da45d2566a1d4e260b894ff5d96be64b21c7fa79",
              "versionType": "git"
            },
            {
              "lessThan": "9855e063e063158cc5bded576382599dc3133202",
              "status": "affected",
              "version": "da45d2566a1d4e260b894ff5d96be64b21c7fa79",
              "versionType": "git"
            },
            {
              "lessThan": "2b56d7903ab804481f5233a259d5f341e9fd513c",
              "status": "affected",
              "version": "da45d2566a1d4e260b894ff5d96be64b21c7fa79",
              "versionType": "git"
            },
            {
              "lessThan": "dd4f4c93c1488d7100b9964f2da4c8b3c29652f1",
              "status": "affected",
              "version": "da45d2566a1d4e260b894ff5d96be64b21c7fa79",
              "versionType": "git"
            },
            {
              "lessThan": "0e7c074cfcd9bd93765505f9eb8b42f03ed2a744",
              "status": "affected",
              "version": "da45d2566a1d4e260b894ff5d96be64b21c7fa79",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wwan/t7xx/t7xx_modem_ops.c",
            "drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c",
            "drivers/net/wwan/t7xx/t7xx_port_proxy.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler\n\nt7xx_port_enum_msg_handler() uses the modem-supplied port_count field as\na loop bound over port_msg-\u003edata[] without checking that the message buffer\ncontains sufficient data. A modem sending port_count=65535 in a 12-byte\nbuffer triggers a slab-out-of-bounds read of up to 262140 bytes.\n\nAdd a sizeof(*port_msg) check before accessing the port message header\nfields to guard against undersized messages.\n\nAdd a struct_size() check after extracting port_count and before the loop.\n\nIn t7xx_parse_host_rt_data(), guard the rt_feature header read with a\nremaining-buffer check before accessing data_len, validate feat_data_len\nagainst the actual remaining buffer to prevent OOB reads and signed\ninteger overflow on offset.\n\nPass msg_len from both call sites: skb-\u003elen at the DPMAIF path after\nskb_pull(), and the validated feat_data_len at the handshake path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable parser consumes control messages supplied by the cellular modem/baseband over PCIe; the realistic worst-case attacker is a rogue base station / over-the-air baseband compromise that pivots to the host kernel, which is the cellular-radio analog of WiFi/Bluetooth adjacency. It is not directly Network-reachable because these are internal AP\u2194modem control messages, not internet-routable packets.\nAC:L - A malicious/compromised modem reliably triggers the OOB read by setting port_count to a large value (up to 65535) in an undersized buffer; there is no race or attacker-uncontrollable precondition, and the ~256 KB read reliably reaches unmapped memory.\nPR:N - The modem\u0027s messages are parsed automatically during the handshake/port-enumeration with no authentication or privilege check on the device-supplied data, so the attacker needs no host-side credentials.\nUI:N - Port enumeration and runtime-feature handshake are processed automatically by kernel threads at modem init and runtime; no user action is required.\nS:U - The vulnerable code and the impacted resource are both the host kernel; there is no crossing into a different security authority such as a VM/hypervisor or IOMMU domain.\nC:H - The flaw is a large slab-out-of-bounds read of up to ~256 KB of adjacent kernel heap, and the read values steer channel enable/disable behavior, providing a disclosure oracle \u2014 well above a few bounded bytes.\nI:H - The out-of-bounds data is interpreted as port_info and drives kernel driver channel enable/disable state, modifying kernel-internal state based on attacker-influenced out-of-bounds memory; rounding up under uncertainty.\nA:H - An out-of-bounds read of up to ~256 KB past a 12-byte slab object reliably crosses into unmapped/poisoned pages, causing a kernel oops/panic (denial of service)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:18.825Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/307c5d0f36a5c74042217136da5bfbd9f7504650"
        },
        {
          "url": "https://git.kernel.org/stable/c/f94450ce5053b36002995b72d1fa1db3bb08c5bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/9855e063e063158cc5bded576382599dc3133202"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b56d7903ab804481f5233a259d5f341e9fd513c"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd4f4c93c1488d7100b9964f2da4c8b3c29652f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e7c074cfcd9bd93765505f9eb8b42f03ed2a744"
        }
      ],
      "title": "net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43495",
    "datePublished": "2026-05-21T12:12:45.988Z",
    "dateReserved": "2026-05-01T14:12:56.013Z",
    "dateUpdated": "2026-08-05T12:28:18.825Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43495",
      "date": "2026-09-19",
      "epss": "0.00261",
      "percentile": "0.18276"
    },
    "microsoft_vex": {
      "current_release_date": "2026-05-22T01:01:39.000Z",
      "cve": "CVE-2026-43495",
      "id": "msrc_CVE-2026-43495",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43495.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wwan/t7xx/t7xx_modem_ops.c",
                  "drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c",
                  "drivers/net/wwan/t7xx/t7xx_port_proxy.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "307c5d0f36a5c74042217136da5bfbd9f7504650",
                    "status": "affected",
                    "version": "da45d2566a1d4e260b894ff5d96be64b21c7fa79",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f94450ce5053b36002995b72d1fa1db3bb08c5bf",
                    "status": "affected",
                    "version": "da45d2566a1d4e260b894ff5d96be64b21c7fa79",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9855e063e063158cc5bded576382599dc3133202",
                    "status": "affected",
                    "version": "da45d2566a1d4e260b894ff5d96be64b21c7fa79",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2b56d7903ab804481f5233a259d5f341e9fd513c",
                    "status": "affected",
                    "version": "da45d2566a1d4e260b894ff5d96be64b21c7fa79",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dd4f4c93c1488d7100b9964f2da4c8b3c29652f1",
                    "status": "affected",
                    "version": "da45d2566a1d4e260b894ff5d96be64b21c7fa79",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0e7c074cfcd9bd93765505f9eb8b42f03ed2a744",
                    "status": "affected",
                    "version": "da45d2566a1d4e260b894ff5d96be64b21c7fa79",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wwan/t7xx/t7xx_modem_ops.c",
                  "drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c",
                  "drivers/net/wwan/t7xx/t7xx_port_proxy.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.19"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.140",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.88",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.30",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "190567C3-238F-444D-89B9-23420EE1EFFB",
                    "versionEndExcluding": "6.1.176",
                    "versionStartIncluding": "5.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D",
                    "versionEndExcluding": "6.6.140",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5AFBE0EC-CCDF-4207-AE92-ABF958125CA4",
                    "versionEndExcluding": "6.12.88",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B",
                    "versionEndExcluding": "6.18.30",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E",
                    "versionEndExcluding": "7.0.7",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler\n\nt7xx_port_enum_msg_handler() uses the modem-supplied port_count field as\na loop bound over port_msg-\u003edata[] without checking that the message buffer\ncontains sufficient data. A modem sending port_count=65535 in a 12-byte\nbuffer triggers a slab-out-of-bounds read of up to 262140 bytes.\n\nAdd a sizeof(*port_msg) check before accessing the port message header\nfields to guard against undersized messages.\n\nAdd a struct_size() check after extracting port_count and before the loop.\n\nIn t7xx_parse_host_rt_data(), guard the rt_feature header read with a\nremaining-buffer check before accessing data_len, validate feat_data_len\nagainst the actual remaining buffer to prevent OOB reads and signed\ninteger overflow on offset.\n\nPass msg_len from both call sites: skb-\u003elen at the DPMAIF path after\nskb_pull(), and the validated feat_data_len at the handshake path."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nnet: wwan: t7xx: validar port_count contra la longitud del mensaje en t7xx_port_enum_msg_handler\n\nt7xx_port_enum_msg_handler() utiliza el campo port_count suministrado por el m\u00f3dem como l\u00edmite de bucle sobre port_msg-\u003edata[] sin verificar que el b\u00fafer del mensaje contenga datos suficientes. Un m\u00f3dem que env\u00eda port_count=65535 en un b\u00fafer de 12 bytes desencadena una lectura fuera de l\u00edmites de slab de hasta 262140 bytes.\n\nA\u00f1adir una verificaci\u00f3n sizeof(port_msg) antes de acceder a los campos de la cabecera del mensaje del puerto para proteger contra mensajes de tama\u00f1o insuficiente.\n\nA\u00f1adir una verificaci\u00f3n struct_size() despu\u00e9s de extraer port_count y antes del bucle.\n\nEn t7xx_parse_host_rt_data(), proteger la lectura de la cabecera rt_feature con una verificaci\u00f3n del b\u00fafer restante antes de acceder a data_len, validar feat_data_len contra el b\u00fafer restante real para prevenir lecturas OOB y desbordamiento de entero con signo en el desplazamiento.\n\nPasar msg_len desde ambos sitios de llamada: skb-\u003elen en la ruta DPMAIF despu\u00e9s de skb_pull(), y el feat_data_len validado en la ruta de handshake."
          }
        ],
        "id": "CVE-2026-43495",
        "lastModified": "2026-07-23T16:10:00.137",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-05-21T13:16:18.847",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0e7c074cfcd9bd93765505f9eb8b42f03ed2a744"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2b56d7903ab804481f5233a259d5f341e9fd513c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/307c5d0f36a5c74042217136da5bfbd9f7504650"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9855e063e063158cc5bded576382599dc3133202"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dd4f4c93c1488d7100b9964f2da4c8b3c29652f1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f94450ce5053b36002995b72d1fa1db3bb08c5bf"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2026/06/18/1"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T06:58:58+00:00",
      "cve": "CVE-2026-43495",
      "id": "CVE-2026-43495",
      "initial_release_date": "2026-05-21T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43495.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:17:05Z",
      "cve": "CVE-2026-43495",
      "id": "CVE-2026-43495",
      "initial_release_date": "2026-05-22T02:20:06Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "91",
      "product_status:known_not_affected": "296",
      "product_status:recommended": "149",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43495",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43495.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.