CVE-2026-95622

{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Keith Linneman and Yehia Ezzat for reporting this issue.", "bugzilla": {"description": "ModemManager: ModemManager: Reachable assertion in Cell Broadcast encoding parse causes denial of service", "id": "2540006", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540006"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["A flaw was found in ModemManager. When parsing a Cell Broadcast Message, some 3GPP data-coding-scheme values (8-bit and reserved character sets) are not handled. The process hits a reachable assertion and aborts. An attacker who can deliver a crafted Cell Broadcast PDU over the radio network, or via a modem AT channel, can cause ModemManager to exit. Repeated aborts can exhaust systemd's default start limit and leave the service failed."], "mitigation": {"lang": "en:us", "value": "On hosts that do not need WWAN, disable or mask ModemManager. There is no practical mitigation for a host that must process Cell Broadcast (emergency channels typically cannot be unsubscribed). The fix is to treat unrecognized encodings as a parse error instead of asserting."}, "name": "CVE-2026-95622", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "ModemManager", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "ModemManager", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "ModemManager", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "ModemManager", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "ModemManager", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-95622\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-95622"], "statement": "This vulnerability impacts ModemManager version 1.24 and above following the introduction of Cell Broadcast parsing. Red Hat Enterprise Linux (RHEL) remains unaffected, as it does not ship these newer versions and lacks the vulnerable code path. Although the reporter assigned a \"Low\" severity rating due to the attack requiring a malicious base station or compromised radio network (reflected in the AV:A vector), a single malicious PDU under those conditions will crash the root ModemManager process.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "product": "modemmanager", "vendor": "modemmanager"}], "created": "2026-09-25T18:00:20.826917+00:00", "updated": "2026-10-04T20:47:44.962538+00:00", "vendors": ["modemmanager", "modemmanager$PRODUCT$modemmanager"]}