Bug 2516762 (CVE-2026-74263)

Summary:	CVE-2026-74263 kernel: net: wwan: t7xx: check skb_clone in control TX
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's Wireless Wide Area Network (WWAN) t7xx driver. The `t7xx_port_ctrl_tx()` function, which handles control transmissions, fails to validate the return value of `skb_clone()`. An attacker with local access could exploit this by triggering a scenario where `skb_clone()` returns a NULL pointer, leading to a NULL pointer dereference. This vulnerability can cause a system crash, resulting in a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:32:12 UTC

In the Linux kernel, the following vulnerability has been resolved:

net: wwan: t7xx: check skb_clone in control TX

t7xx_port_ctrl_tx() clones each skb fragment before passing it to the
port transmit path. The clone is used immediately to set cloned->len, so
an skb_clone() failure results in a NULL pointer dereference.

Check the clone before using it. If previous fragments were already
queued, preserve the driver's existing partial-write behavior by
returning the number of bytes submitted so far.

Comment 1 Keith Grant 2026-08-19 19:18:19 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081542-CVE-2026-74263-6a02@gregkh/T