The Linux kernel’s wwan IoSM driver contains a flaw in the MUX downlink decoder where offsets and lengths supplied by a modem device are insufficiently validated. Only the first index is checked for being non‑zero; all other indices and lengths are used unchecked to walk a chain of datagram tables. This omission permits a malicious modem to provide an offset or length that extends past the skb buffer, causing the kernel to read memory beyond the intended region. Additionally, the decoder does not enforce forward progress on the table chain. A modem can stage two tables that reference each other, resulting in an infinite loop that repeatedly clones the skb in softirq, potentially exhausting kernel resources and leading to a denial‑of‑service condition.

All Linux kernel builds that include the wwan IoSM driver are potentially affected, as the advisory does not specify fixed or affected versions. In the absence of explicit version information, we infer that any kernel version pre‑patch contains the flaw. Systems running an upstream kernel without the applied patch should consider this vulnerability relevant, irrespective of which distribution or kernel release they use.

The CVSS score of 8.8 marks the vulnerability as high severity. The EPSS score is reported as less than 1 %, indicating a low probability of exploitation in the wild at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a modem that can deliver crafted MUX downlink packets; thus, the attack vector is inferred to be local control of the modem interface. If an attacker supplies malicious offsets, the kernel will perform an out‑of‑bounds read, potentially leaking arbitrary kernel memory, or, if the malicious table loop is activated, the system may suffer a denial‑of‑service by consuming kernel memory and processing resources. Therefore the risk remains significant for systems that accept untrusted modem traffic, while the likelihood of exploitation outside controlled environments is currently low.