CVE-2026-98236

A flaw was found in the Linux kernel's MHI MBIM (Modem Host Interface Mobile Broadband Interface Model) driver. When receiving network data, the driver ignores the return value of memory copy operations when extracting datagrams. A compromised or malicious modem can supply crafted datagram offsets that cause the copy operation to fail, leaving uninitialized buffer memory in place. The driver then forwards this uninitialized buffer into the network stack, resulting in kernel heap information disclosure.

This vulnerability is rated as Moderate severity because exploitation requires the presence of specialized MHI MBIM modem hardware or a compromised cellular device attached to the host. In typical Red Hat Enterprise Linux server and cloud deployments, mobile broadband WWAN hardware is rarely configured, substantially restricting real-world exposure. Furthermore, the defect results in an uninitialized heap memory disclosure rather than enabling direct code execution or elevated system control.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.