HIGH Introduced in 6.2
mt7996 EEPROM OOB
CVE-2026-80935
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr, a device-controlled __le32) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past eeprom.data. Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.
02KernelScan AI Analysis
Risk summary
Systems using MediaTek Wi-Fi 7 (mt7996) PCIe devices are at risk if a malicious or malfunctioning WiFi chipset reports an arbitrary EEPROM address, driving an out-of-bounds write into kernel heap memory. Exploitation requires physical access to swap or tamper with the WiFi card, or prior compromise of the device firmware. The resulting kernel memory corruption can lead to privilege escalation or system crash.
Vulnerability analysis
The MediaTek mt7996 WiFi driver reads EEPROM data from the device's microcontroller and uses an address field from the device's response as a write offset into a kernel buffer, but never validates that the offset stays within the buffer. A malicious or malfunctioning WiFi chipset can report an arbitrary address, causing the driver to copy up to a full EEPROM block past the end of the allocated buffer. The fix adds a bounds check that rejects any MCU response whose address would place the copy outside the EEPROM buffer before the destination pointer is derived. The vulnerable path is reached automatically when the mt7996 driver loads and queries the device for EEPROM data, so an attacker needs either a physically tampered PCIe WiFi card or a device whose firmware has been compromised to report a malicious address.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.2 | 6.12.112 | 388f471ca475 |
| 6.18 | 6.2 | 6.18.52 | 9e5abb5e2ade |
| 7.2 | 6.2 | 7.2.4 | 6be59da2063d |
| mainline | 6.2 | 7.3-rc1 | 13b3c29a7820 |