CVE-2026-98237

A flaw was found in the Linux kernel's MHI Mobile Broadband Interface Model (MBIM) driver. This flaw allows a malicious or compromised modem to cause a Denial of Service (DoS) by sending network frames with cyclic Network Datagram Pointer (NDP) chains that do not advance. Processing these cyclic descriptors causes an infinite loop in the driver, pinning a CPU core at full capacity and hanging the receiving thread.

A low-impact denial of service flaw was found in the Linux kernel MHI WWAN MBIM driver (mhi_wwan_mbim). When the driver receives a Network Transfer Block (NTB), the NDP traversal loop in mhi_mbim_rx() only stops when the next NDP index is zero and does not verify that the offsets advance. A malicious or compromised modem can therefore deliver frames with a cyclic or self-referential Network Datagram Pointer (NDP) chain, driving the driver into an infinite loop that pins a CPU core at 100% and hangs the receive thread. Confidentiality and integrity are not affected.

Red Hat rates this flaw as low severity because the attack requires a malicious or compromised modem attached over the MHI bus; ordinary network traffic does not control the NDP metadata produced by modem firmware, so an arbitrary remote peer cannot trigger the loop.

The MHI MBIM driver is present in Red Hat Enterprise Linux 9 (from 9.3 onward), Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS 9 based OpenShift Container Platform releases (4.16 and later, including 5.x), which are affected. Fixes for these streams are currently deferred to a future update; the residual risk of deferral is limited to a local denial of service (CPU exhaustion on one core) that requires attacker-controlled modem hardware or firmware. Red Hat Enterprise Linux 6, 7, 8, and RHEL 9.2, as well as OpenShift Container Platform 4.15 and earlier (including the RHEL CoreOS 8 based releases), are not affected because the vulnerable driver code is not present in those versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.