Linux kernel (mt76 mt7996 driver) vulnerabilities

In the Linux kernel, mt7996_mcu_get_eeprom() in the mt76 wifi driver (mt7996 chipset) derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past eeprom.data.

In the Linux kernel, mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames but are otherwise FW-TXP devices. On tx free, mt76_connac_txp_skb_unmap() decodes the per-frame txp as a struct mt76_connac_fw_txp, so the unmap loop runs zero times and the skb DMA mapping in buf[1] is never unmapped. Each AddBA req leaks one TX DMA mapping, exhausting the WED swiotlb pool after ~1-2 days under continuous client reconnect churn.

In the Linux kernel, the default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during variant validation or the fallback copy.