The vulnerability in the Linux kernel’s wwan driver exposes a potential buffer overflow when handling received packet fragments. In the DPMAIF RX path, the t7xx_dpmaif_set_frag_to_skb() function adds page fragments to an skb without verifying that the fragment count remains within the MAX_SKB_FRAGS limit. If firmware supplies more fragments than the kernel expects, the skb_shinfo(skb)->frags array can be overrun, corrupting adjacent memory and causing kernel crashes or other undefined behaviour.

All Linux kernel distributions that ship the v6.19 release series are affected, including the release candidates rc1 through rc7 enumerated in the Common Platform Enumeration strings. The fix applies to the generic Linux vendor and product, so any distribution still using the unpatched kernel falls under this scope.

The vulnerability carries a high CVSS base score of 8.4, yet the EPSS probability is below 1%, indicating a low exploitation likelihood at present. It is not listed in the CISA KEV catalog. Exploitation would require an attacker to manipulate or compromise modem firmware to transmit packets with excessive fragments, making the attack vector local to the device or remote if firmware injection can be achieved. Successful exploitation could corrupt kernel memory, leading to denial of service or potentially enabling privilege escalation.