CVE-2026-23315

wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()

State: Published
Severity: Not scored
Published: Mar 25, 2026
Updated: Oct 15, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()

Check frame length before accessing the mgmt fields in mt76_connac2_mac_write_txwi_80211 in order to avoid a possible oob access.

[fix check to also cover mgmt->u.action.u.addba_req.capab, correct Fixes tag]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	577dbc6c656da6997dddc6cf842b7954588f2d4e to before 84419556359bc96d3fe1623d47a64c86542566ccAffected 577dbc6c656da6997dddc6cf842b7954588f2d4e to before 7ae7b093b7dba9548a3bc4766b9364b97db4732dAffected 577dbc6c656da6997dddc6cf842b7954588f2d4e to before 7b692dff8df0ba5feb8df00f27d906d6eb1fe627Affected 577dbc6c656da6997dddc6cf842b7954588f2d4e to before 9612d91f617231e03c49cb9b0c02f975a3b4f51fAffected 577dbc6c656da6997dddc6cf842b7954588f2d4e to before 0fb3b94a9431a3800717e5c3b6fa2e1045a15029Affected 577dbc6c656da6997dddc6cf842b7954588f2d4e to before 4e10a730d1b511ff49723371ed6d694dd1b2c785Affected
LinuxLinux	5.10Affected before 5.10Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.77 through 6.12.Not affected 6.18.17 through 6.18.Not affected 6.19.7 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

577dbc6c656da6997dddc6cf842b7954588f2d4e to before 84419556359bc96d3fe1623d47a64c86542566ccAffected
577dbc6c656da6997dddc6cf842b7954588f2d4e to before 7ae7b093b7dba9548a3bc4766b9364b97db4732dAffected
577dbc6c656da6997dddc6cf842b7954588f2d4e to before 7b692dff8df0ba5feb8df00f27d906d6eb1fe627Affected
577dbc6c656da6997dddc6cf842b7954588f2d4e to before 9612d91f617231e03c49cb9b0c02f975a3b4f51fAffected
577dbc6c656da6997dddc6cf842b7954588f2d4e to before 0fb3b94a9431a3800717e5c3b6fa2e1045a15029Affected
577dbc6c656da6997dddc6cf842b7954588f2d4e to before 4e10a730d1b511ff49723371ed6d694dd1b2c785Affected

LinuxLinux

5.10Affected
before 5.10Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.77 through 6.12.*Not affected
6.18.17 through 6.18.*Not affected
6.19.7 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.