CVE-2024-57990

What it actually does

Off-by-one error in mt7925_load_clc() allows out-of-bounds read and write due to incorrect boundary check (using > instead of >=).

Why it matters to the business

Systems using mt7925 wireless hardware may experience kernel crashes, memory corruption, or potential privilege escalation, disrupting operations and requiring urgent kernel updates across fleets with affected hardware.

How an attack unfolds

An attacker with local access or the ability to influence the wireless driver initialization triggers mt7925_load_clc() with crafted conditions that exceed the intended array bounds, leading to memory corruption that can be leveraged for further exploitation.

How to fix it

Update the Linux kernel to a version containing commit 98f7e32f20d28ec452afb208f9cffc08448a2652 or later; rebuild and deploy the updated kernel image on all affected systems.

How to confirm the fix worked

Confirm the running kernel source includes commit 98f7e32f20d28ec452afb208f9cffc08448a2652; verify the comparison in mt7925_load_clc() uses >= and test driver initialization with mt7925 hardware.

Typical attack path

1. Obtain local access or trigger wireless driver load on vulnerable kernel
2. Invoke mt7925_load_clc() with input that hits the off-by-one boundary condition
3. Perform out-of-bounds read/write to corrupt kernel memory structures
4. Escalate to arbitrary code execution or denial of service

How to detect it

Review kernel logs for crashes or warnings originating from mt76/mt7925 driver initialization; inspect for unexpected memory access violations during wireless device probe.

What your security team should do

• Prioritize kernel updates on all systems with mt7925 hardware within standard patch windows
• Monitor for related kernel memory corruption indicators in system logs
• Restrict untrusted local access until patches are applied