CVE-2026-95622

A flaw was found in ModemManager. When parsing a Cell Broadcast Message, some 3GPP data-coding-scheme values (8-bit and reserved character sets) are not handled. The process hits a reachable assertion and aborts. An attacker who can deliver a crafted Cell Broadcast PDU over the radio network, or via a modem AT channel, can cause ModemManager to exit. Repeated aborts can exhaust systemd's default start limit and leave the service failed.

This vulnerability impacts ModemManager version 1.24 and above following the introduction of Cell Broadcast parsing. Red Hat Enterprise Linux (RHEL) remains unaffected, as it does not ship these newer versions and lacks the vulnerable code path. Although the reporter assigned a "Low" severity rating due to the attack requiring a malicious base station or compromised radio network (reflected in the AV:A vector), a single malicious PDU under those conditions will crash the root ModemManager process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.