HIGH Introduced in 5.8
mt76 mt7915 Eeprom OOB Write
CVE-2026-80937
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data buffer at the offset reported by the MCU response (res->addr, a device-controlled __le32) without checking it against the buffer size. A malicious or malfunctioning device can report an arbitrary address and drive a 16-byte out-of-bounds write past eeprom.data. Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.
02KernelScan AI Analysis
Risk summary
A malicious or malfunctioning MT7915 Wi-Fi chipset can report an arbitrary EEPROM address in its MCU response, causing the driver to write 16 bytes past the end of the EEPROM data buffer. This is a local OOB write reachable from a privileged user with access to the device, resulting in kernel memory corruption and potential denial of service.
Vulnerability analysis
The MT7915 Wi-Fi driver copies a fixed-size EFUSE block from the device's MCU response into a driver-allocated EEPROM buffer at an offset supplied by the device itself. Because the driver never validated that offset against the buffer size, a malicious or faulty device could report an arbitrary address and trigger a 16-byte out-of-bounds write past the end of the buffer. The fix adds a bounds check that rejects any MCU response whose address would place the copy outside the EEPROM buffer before the write occurs. The vulnerable path is reached through the MT7915 PCIe Wi-Fi driver and requires the device to be present and the driver loaded; a privileged user with access to the device's debugfs or firmware interaction path can trigger the EEPROM read that leads to the corruption.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 5.8 | 6.12.112 | 394e8cb56fc7 |
| 6.18 | 5.8 | 6.18.50 | 5fdaf7016d76 |
| 7.2 | 5.8 | 7.2.4 | 5f48b0d752a7 |
| mainline | 5.8 | 7.3-rc1 | 44b5adfe4949 |