CVE-2026-80935
UnknownSummary
In the Linux kernel, mt7996_mcu_get_eeprom() in the mt76 wifi driver (mt7996 chipset) derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past eeprom.data.
Risk Assessment
The vulnerability allows kernel memory corruption (out-of-bounds write) triggered by a controlled WiFi device, potentially leading to system instability or kernel code execution. It requires malicious or faulty hardware.
Recommendation
Update the Linux kernel to a version containing the fix that rejects MCU responses whose address would place the copy outside eeprom.data before deriving the destination pointer.
Other vulnerabilities in Linux kernel (mt76 mt7996 driver)
See all- CVE-2026-80934Unknown
In the Linux kernel, mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames but are otherwise FW-TXP devices. On tx free, mt76_connac_txp_skb_unmap() decodes the per-frame txp as a struct mt76_connac_fw_txp, so the unmap loop runs zero times and the skb DMA mapping in buf[1] is never unmapped. Each AddBA req leaks one TX DMA mapping, exhausting the WED swiotlb pool after ~1-2 days under continuous client reconnect churn.
- CVE-2026-80933Unknown
In the Linux kernel, the default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during variant validation or the fallback copy.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr, a device-controlled __le32) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past eeprom.data. Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.