Riskcovery

CVE-2026-80935

wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy

State
Published
Severity
8.8 High
Published
Sep 11, 2026
Updated
Oct 21, 2026
Reserved
Aug 26, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy

mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr, a device-controlled __le32) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past eeprom.data.

Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 98686cd21624c75a043e96812beadddf4f6f48e5 to before 4892be1ef0bbe6db6b13bf46cb79b6706bb5b214Affected
  • 98686cd21624c75a043e96812beadddf4f6f48e5 to before 388f471ca4758f644394b681ce97677a4d0e772cAffected
  • 98686cd21624c75a043e96812beadddf4f6f48e5 to before 9e5abb5e2ade0b6fd0e47209711115d47a255176Affected
  • 98686cd21624c75a043e96812beadddf4f6f48e5 to before 6be59da2063d5b3522bfde8aae0487ec095eb384Affected
  • 98686cd21624c75a043e96812beadddf4f6f48e5 to before 13b3c29a782033ce4a230be9e5618032813dbcd4Affected
LinuxLinux
  • 6.2Affected
  • before 6.2Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.112 through 6.12.*Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.4 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.