CVE-2026-72029

The severity in CVE-2026-72029 comes from an OOB read in the IOSM driver's mux_dl_adb_decode function, which the CVSS 8.8 captures. But the vulnerability's actual significance is the trust model failure that makes it possible: the kernel treats the WWAN modem as a trusted actor and walks table chains using device-supplied indices without forward-progress guarantees. This isn't just a missing bounds check—it's a fundamentally broken assumption about peripheral behavior that manifests in two distinct failure modes with wildly different blast radii. The OOB read is a contained failure affecting the driver and buffer in question. The DoS vector through table cycling is systemic. If a modem stages two tables pointing at each other, the decoder loops infinitely in softirq context, calling skb_clone() on every iteration. You're not starving the WWAN stack—you're starving all softirq consumers: network RX on every interface, timer wheels, tasklets. A crash in process context is a process failure. Resource exhaustion in softirq context is a kernel-wide availability failure with different recovery characteristics—you can't kill the offending process. The patch adds six bounds validations at different points in the decode path. That's the immediate fix. But the deeper issue is that the driver's threat model was never documented or enforced. The modem runs carrier-updatable firmware with minimal oversight, exists on a shared memory bus where DMA transactions aren't automatically IOMMU-validated the way network packets are, and the code treated 'first_table_index != 0' as sufficient validation. Everything else was implicitly trusted because it came from a legitimate device. For defenders: audit other IOSM code paths that trust modem-supplied offsets. Check whether IPC_MEM_MAX_DL_MUX_LITE_BUF_SIZE is enforced at driver entry or only assumed. Examine other WWAN mux implementations for the same table-walking pattern with device-supplied indices—if this driver's trust assumptions are broken, the architectural question is whether the subsystem inherited the same flawed model. The forward-progress check in the patch uses relative monotonicity (each index must 'move forward') rather than absolute position tracking, which means tables with monotonically advancing but cycling offsets may still pass. Consider whether your threat model should treat modem firmware as a potential adversarial surface rather than just an unreliable actor.

Reviewed through automated stages and approved by a human before publication.