Riskcovery

CVE-2026-80937

wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

State
Published
Severity
8.8 High
Published
Sep 11, 2026
Updated
Oct 30, 2026
Reserved
Aug 26, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data buffer at the offset reported by the MCU response (res->addr, a device-controlled __le32) without checking it against the buffer size. A malicious or malfunctioning device can report an arbitrary address and drive a 16-byte out-of-bounds write past eeprom.data.

Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e57b7901469fc0b021930b83a8094baaf3d81b09 to before ef10a2ec2a74c4a6aa5c086fc0c2b01037569134Affected
  • e57b7901469fc0b021930b83a8094baaf3d81b09 to before d6774f6af3711143a93281904a928a78652c8b7eAffected
  • e57b7901469fc0b021930b83a8094baaf3d81b09 to before 394e8cb56fc732d71041599cdb4e01f82cfd11c5Affected
  • e57b7901469fc0b021930b83a8094baaf3d81b09 to before 5fdaf7016d7684ef756a229fd5d96b4a140eeb40Affected
  • e57b7901469fc0b021930b83a8094baaf3d81b09 to before 5f48b0d752a76590e2c613aae5345c2474627d1bAffected
  • e57b7901469fc0b021930b83a8094baaf3d81b09 to before 44b5adfe49499f53002737f5fe81d608c08122fcAffected
LinuxLinux
  • 5.8Affected
  • before 5.8Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.112 through 6.12.*Not affected
  • 6.18.50 through 6.18.*Not affected
  • 7.2.4 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.