CVE-2026-74263net: wwan: t7xx: check skb_clone in control TX
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skb_clone in control TX t7xx_port_ctrl_tx() clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned->len, so an skb_clone() failure results in a NULL pointer dereference. Check the clone before using it. If previous fragments were already queued, preserve the driver's existing partial-write behavior by returning the number of bytes submitted so far.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 36bd28c1cb0dbf48645cfe43159907fb3253b33a builds before 7edd4db82f9429591de10be4c904c817f12ba029; from 36bd28c1cb0dbf48645cfe43159907fb3253b33a before 112490467586146d323cb7230b1d72137e36900c; from 36bd28c1cb0dbf48645cfe43159907fb3253b33a before f7aebaee2961bfcb86f282202d3dbd9b69db1a7c; 36bd28c1cb0dbf48645cfe43159907fb3253b33a builds before 4c1b25d85f4c9a0f85f3f8c39988ad266a3f3095; 36bd28c1cb0dbf48645cfe43159907fb3253b33a builds before 05f789fa90d95d5771230e78453cedff2486039d | CNA record |
References
- https://git.kernel.org/stable/c/7edd4db82f9429591de10be4c904c817f12ba029
- https://git.kernel.org/stable/c/112490467586146d323cb7230b1d72137e36900c
- https://git.kernel.org/stable/c/f7aebaee2961bfcb86f282202d3dbd9b69db1a7c
- https://git.kernel.org/stable/c/4c1b25d85f4c9a0f85f3f8c39988ad266a3f3095
- https://git.kernel.org/stable/c/05f789fa90d95d5771230e78453cedff2486039d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.