CVE-2026-15461

The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor standalone/hl78xx/) embeds a generic struct gnss nmea0183 match data match data inside struct hl78xx gnss data. The generic NMEA0183 match helper (drivers/gnss/gnss nmea0183 match.c) requires that context to be the first member because its callbacks cast user data directly to struct gnss nmea0183 match data . In the affected releases match data was the second member (after const struct device dev), so it sat at a non-zero offset while gnss nmea0183 match init() initialized it at the correct address. The registered NMEA handlers instead pass the whole device data object (data->devices.gnss->data, offset 0), producing an offset-shifted type confusion between where state is initialized and where the parse callbacks read and write it.

When NMEA sentences from the GNSS receiver are parsed, the GGA/RMC callbacks write parsed fix data into the wrong location within the struct, and the GSV callback (gnss nmea0183 match gsv callback, active under CONFIG GNSS SATELLITES) reads its satellites pointer and bound from the wrong offsets — non-pointer bytes of struct hl78xx gnss data — and then writes parsed struct gnss satellite entries through that bogus pointer. This is a write through an uninitialized/wild pointer with a garbage bound.

The NMEA handlers are registered by default (CONFIG HL78XX GNSS SOURCE NMEA is the default GNSS source) on devices using the HL78xx GNSS. The driver runs in kernel context and the NMEA data originates from the GNSS radio front-end, so a party able to influence the GNSS signal (for example GNSS/GPS spoofing at radio proximity) can drive the kernel-side parser into the faulty write. The most likely impact is a crash (denial of service) because the bogus pointer resolves to a fixed near-NULL value, with adjacent-memory corruption possible on MMU-less targets. Confidentiality is not affected. Exploitation requires the satellites feature to be enabled and active, so attack complexity is high.