mt76 DefaultEeprom OOB

Vulnerability analysis

The MediaTek mt7996 Wi-Fi 7 driver loads a default EEPROM firmware file during device initialization without first checking that the file is large enough. A truncated firmware file causes the driver to read past the end of the allocated firmware buffer when validating the EEPROM variant or copying the data into the device's EEPROM structure, potentially leaking adjacent kernel heap data or crashing the kernel if the read crosses into unmapped memory. The fix adds a size check that rejects any firmware file shorter than the expected EEPROM size before any parsing or copying begins. This vulnerability requires the mt7996 driver to be loaded—meaning specific MediaTek Wi-Fi 7 hardware must be present—and an attacker to have replaced the default EEPROM firmware file on disk, which requires root-level write access to the firmware directory.