CVE-2026-95622: cbm: don't assert handling unsupported encodings (8-bit and reserved)

A cell broadcast message using unsupported encodings would trigger an
assert in ModemManager and kill the process. A compromised base station
or modem firmware could craft or pass through these messages.

Reported by Yehia Ezzat and Keith Linneman

Impact: Moderate
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5 Medium)
CWE-617 (Reachable Assertion)

Signed-off-by: Dan Williams <dan@ioncontrol.co>

src/mm-cbm-part.c

@@ -225,7 +225,9 @@ mm_cbm_part_new_from_binary_pdu (const guint8  *pdu,
             cbm_part->encoding = MM_SMS_ENCODING_GSM7;
         else if (charset == CBS_DATA_CODING_GENERAL_UCS2)
             cbm_part->encoding = MM_SMS_ENCODING_UCS2;
-    } else {
+    }
+
+    if (cbm_part->encoding == MM_SMS_ENCODING_UNKNOWN) {
         g_set_error (error,
                      MM_CORE_ERROR,
                      MM_CORE_ERROR_FAILED,

src/tests/test-cbm-part.c

@@ -161,6 +161,54 @@ test_cbm_eu (void)
     g_assert_cmpstr (mm_cbm_part_get_language (part), ==, "en");
 }
 
+static void
+test_cbm_unhandled_data_coding_group_general_charset_reserved (void)
+{
+    g_autoptr(GError) err = NULL;
+    g_autoptr(MMCbmPart) part = NULL;
+
+    static const guint8 pdu [] = {
+        0x63, 0x40, 0x00, 0x32, 0x5C, 0x14,
+        0x00, 0x20, 0x04, 0x1f, 0x04, 0x40, 0x04, 0x3e,
+        0x04, 0x42, 0x04, 0x4f, 0x04, 0x33, 0x04, 0x3e,
+        0x04, 0x3c, 0x00, 0x20, 0x04, 0x34, 0x04, 0x3d,
+        0x04, 0x4f, 0x00, 0x20, 0x04, 0x54, 0x00, 0x20,
+        0x04, 0x32, 0x04, 0x38, 0x04, 0x41, 0x04, 0x3e,
+        0x04, 0x3a, 0x04, 0x30, 0x00, 0x20, 0x04, 0x56,
+        0x04, 0x3c, 0x04, 0x3e, 0x04, 0x32, 0x04, 0x56,
+        0x04, 0x40, 0x04, 0x3d, 0x04, 0x56, 0x04, 0x41,
+        0x04, 0x42, 0x04, 0x4c, 0x00, 0x20, 0x04, 0x40,
+        0x04, 0x30, 0x04, 0x3a, 0x04, 0x35, 0x04, 0x42,
+        0x04, 0x3d, 0x16, 0x01, 0x00, 0x00};
+
+    part = mm_cbm_part_new_from_binary_pdu (pdu, G_N_ELEMENTS (pdu), NULL, &err);
+    g_assert_error (err, MM_CORE_ERROR, MM_CORE_ERROR_FAILED);
+}
+
+static void
+test_cbm_unhandled_data_coding_group_general_charset_8bit (void)
+{
+    g_autoptr(GError) err = NULL;
+    g_autoptr(MMCbmPart) part = NULL;
+
+    static const guint8 pdu [] = {
+        0x63, 0x40, 0x00, 0x32, 0x54, 0x14,
+        0x00, 0x20, 0x04, 0x1f, 0x04, 0x40, 0x04, 0x3e,
+        0x04, 0x42, 0x04, 0x4f, 0x04, 0x33, 0x04, 0x3e,
+        0x04, 0x3c, 0x00, 0x20, 0x04, 0x34, 0x04, 0x3d,
+        0x04, 0x4f, 0x00, 0x20, 0x04, 0x54, 0x00, 0x20,
+        0x04, 0x32, 0x04, 0x38, 0x04, 0x41, 0x04, 0x3e,
+        0x04, 0x3a, 0x04, 0x30, 0x00, 0x20, 0x04, 0x56,
+        0x04, 0x3c, 0x04, 0x3e, 0x04, 0x32, 0x04, 0x56,
+        0x04, 0x40, 0x04, 0x3d, 0x04, 0x56, 0x04, 0x41,
+        0x04, 0x42, 0x04, 0x4c, 0x00, 0x20, 0x04, 0x40,
+        0x04, 0x30, 0x04, 0x3a, 0x04, 0x35, 0x04, 0x42,
+        0x04, 0x3d, 0x16, 0x01, 0x00, 0x00};
+
+    part = mm_cbm_part_new_from_binary_pdu (pdu, G_N_ELEMENTS (pdu), NULL, &err);
+    g_assert_error (err, MM_CORE_ERROR, MM_CORE_ERROR_FAILED);
+}
+
 static void
 parse_cbm (const char *str, MMCbmPart **part)
 {
@@ -328,6 +376,9 @@ int main (int argc, char **argv)
     g_test_add_func ("/MM/CBM/PDU-Parser/has-7bit-lang", test_cbm_ucs2_with_7bit_lang);
     /* UCS2 message with additional padding: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/issues/253#note_3355339 */
     g_test_add_func ("/MM/CBM/PDU-Parser/UCS2/pad", test_cbm_ucs2_pad);
+    /* Ensure unhandled encodings don't trigger asserts */
+    g_test_add_func ("/MM/CBM/PDU-Parser/8bit/error", test_cbm_unhandled_data_coding_group_general_charset_8bit);
+    g_test_add_func ("/MM/CBM/PDU-Parser/reserved/error", test_cbm_unhandled_data_coding_group_general_charset_reserved);
 
     return g_test_run ();
 }