A Linux kernel WWAN driver for T7xx modems uses a modem‑supplied port_count value as a loop bound without checking that the surrounding message buffer contains enough data. When a modem sends a port_count of 65535 in a very short 12‑byte payload, the driver performs an out‑of‑bounds read of up to 262 140 bytes from kernel memory, potentially exposing sensitive data. The vulnerability also mentions a signed integer overflow, but it is not confirmed whether this leads to further memory corruption.

All Linux kernel releases that include the t7xx WWAN driver before the patch has been applied; this includes any system that loads the T7xx modem driver and accepts messages from an external modem interface.

An attacker who can control or spoof messages sent to the WWAN interface can trigger the malformed port_count exploit, enabling the reading of arbitrary kernel memory. No public exploit is known and the signed integer overflow is not confirmed to produce additional damage. Because the bug is not listed in the CISA KEV catalog and no exploit metrics are available, the risk is limited primarily to information disclosure in environments where untrusted modems are accepted. The lack of bounds checks may increase the likelihood of successful exploitation, as inferred from the text.