HIGH Introduced in 6.19
mt76 MmioCopy OOB
CVE-2026-90369
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix out-of-bounds access in mmio copy helpers mt76_mmio_write_copy() and mt76_mmio_read_copy() iterate up to ALIGN(len, 4), so a length that is not a multiple of four reads past the source buffer (write_copy) or writes past the destination (read_copy). Copy the aligned body in the loop and handle the remaining tail through a 4-byte bounce buffer, keeping the register access width unchanged.
02KernelScan AI Analysis
Risk summary
The MediaTek mt76 WiFi driver's MMIO copy helpers round transfer lengths up to a multiple of four, causing one-to-three-byte out-of-bounds reads and writes when the length is not aligned. Any device using an affected mt76 WiFi chipset is vulnerable to memory corruption from an attacker within radio range, with no authentication required. The impact ranges from kernel crash to potential arbitrary code execution.
Vulnerability analysis
The MediaTek mt76 WiFi driver contains helper functions that copy data to and from hardware registers. These functions round the transfer length up to a multiple of four bytes, so when the requested length is not evenly divisible by four they read beyond the end of the source buffer or write past the end of the destination buffer, which is typically a small stack array. The corrected code copies only the intended number of bytes and safely handles any remaining partial-word data without crossing buffer boundaries. Because the driver processes incoming wireless traffic, an attacker within WiFi radio range can trigger the vulnerable register-copy path; no login or privileges are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 6.19 | 7.2.6 | 6ed0fba58bb1 |
| mainline | 6.19 | 7.3 | 6689b4a65e88 |