CVE-2026-80935wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr, a device-controlled __le32) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past eeprom.data. Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 98686cd21624c75a043e96812beadddf4f6f48e5 builds before 388f471ca4758f644394b681ce97677a4d0e772c; 98686cd21624c75a043e96812beadddf4f6f48e5 builds before 9e5abb5e2ade0b6fd0e47209711115d47a255176; 98686cd21624c75a043e96812beadddf4f6f48e5 builds before 6be59da2063d5b3522bfde8aae0487ec095eb384; 98686cd21624c75a043e96812beadddf4f6f48e5 builds before 13b3c29a782033ce4a230be9e5618032813dbcd4 | CNA record |
References
- https://git.kernel.org/stable/c/388f471ca4758f644394b681ce97677a4d0e772c
- https://git.kernel.org/stable/c/9e5abb5e2ade0b6fd0e47209711115d47a255176
- https://git.kernel.org/stable/c/6be59da2063d5b3522bfde8aae0487ec095eb384
- https://git.kernel.org/stable/c/13b3c29a782033ce4a230be9e5618032813dbcd4
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.