CVE-2026-74263

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: check skb_clone in control TX t7xx_port_ctrl_tx() clones each skb fragment before passing it to the port transmit path. The clone is used immediately to set cloned->len, so an skb_clone() failure results in a NULL pointer dereference. Check the clone before using it. If previous fragments were already queued, preserve the driver's existing partial-write behavior by returning the number of bytes submitted so far.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/05f789fa90d95d5771230e78453cedff2486039d
https://git.kernel.org/stable/c/112490467586146d323cb7230b1d72137e36900c
https://git.kernel.org/stable/c/4c1b25d85f4c9a0f85f3f8c39988ad266a3f3095
https://git.kernel.org/stable/c/7edd4db82f9429591de10be4c904c817f12ba029
https://git.kernel.org/stable/c/f7aebaee2961bfcb86f282202d3dbd9b69db1a7c

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-15 06:22

Updated : 2026-08-17 06:19

NVD link : CVE-2026-74263

Mitre link : CVE-2026-74263

CVE.ORG link : CVE-2026-74263

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-74263", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "36bd28c1cb0dbf48645cfe43159907fb3253b33a", "lessThan": "7edd4db82f9429591de10be4c904c817f12ba029", "versionType": "git"}, {"status": "affected", "version": "36bd28c1cb0dbf48645cfe43159907fb3253b33a", "lessThan": "112490467586146d323cb7230b1d72137e36900c", "versionType": "git"}, {"status": "affected", "version": "36bd28c1cb0dbf48645cfe43159907fb3253b33a", "lessThan": "f7aebaee2961bfcb86f282202d3dbd9b69db1a7c", "versionType": "git"}, {"status": "affected", "version": "36bd28c1cb0dbf48645cfe43159907fb3253b33a", "lessThan": "4c1b25d85f4c9a0f85f3f8c39988ad266a3f3095", "versionType": "git"}, {"status": "affected", "version": "36bd28c1cb0dbf48645cfe43159907fb3253b33a", "lessThan": "05f789fa90d95d5771230e78453cedff2486039d", "versionType": "git"}], "programFiles": ["drivers/net/wwan/t7xx/t7xx_port_wwan.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"status": "unaffected", "version": "0", "lessThan": "6.4", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/wwan/t7xx/t7xx_port_wwan.c"], "defaultStatus": "affected"}]}], "published": "2026-08-15T06:22:25.570", "references": [{"url": "https://git.kernel.org/stable/c/05f789fa90d95d5771230e78453cedff2486039d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/112490467586146d323cb7230b1d72137e36900c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4c1b25d85f4c9a0f85f3f8c39988ad266a3f3095", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7edd4db82f9429591de10be4c904c817f12ba029", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f7aebaee2961bfcb86f282202d3dbd9b69db1a7c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: t7xx: check skb_clone in control TX\n\nt7xx_port_ctrl_tx() clones each skb fragment before passing it to the\nport transmit path. The clone is used immediately to set cloned->len, so\nan skb_clone() failure results in a NULL pointer dereference.\n\nCheck the clone before using it. If previous fragments were already\nqueued, preserve the driver's existing partial-write behavior by\nreturning the number of bytes submitted so far."}], "lastModified": "2026-08-17T06:19:19.870", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}