Cloudanix VulnDB

CVE-2026-23315

High · 7.1

CVSS

7.1

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux wireless networking code could let someone already on the computer peek at private memory or crash the machine.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing frame length validation before dereferencing management frame fields in mt76_connac2_mac_write_txwi_80211 allows out-of-bounds memory access in the MediaTek mt76 Wi-Fi driver.

Why it matters to the business

Local attackers on affected Linux systems can read kernel memory or trigger crashes that disrupt wireless connectivity; the Linux kernel's ubiquity across servers, desktops, and embedded devices amplifies exposure even though exploitation remains theoretical.

How an attack unfolds

An attacker with local code execution crafts or manipulates 802.11 management frames so that mt76_connac2_mac_write_txwi_80211 reads past the end of the supplied buffer when inspecting fields such as action frames or addba capabilities.

How to fix it

Upgrade the Linux kernel to a version containing the upstream fix that adds the frame-length check before accessing mgmt fields in mt76_connac2_mac_write_txwi_80211; rebuild and reboot any custom kernels or distributions that carry the vulnerable driver code.

How to confirm the fix worked

Confirm the presence of the length check preceding the mgmt->u.action.u.addba_req.capab access in the mt76_connac2_mac_write_txwi_80211 function in the running kernel source or via kernel version strings that post-date the published fix.

Typical attack path

  1. Obtain local shell or process execution on a Linux host using the mt76 driver
  2. Trigger transmission or reception of 802.11 management frames that reach the vulnerable write_txwi path
  3. Supply a frame whose length is shorter than expected by the subsequent field accesses
  4. Read out-of-bounds memory or cause a kernel panic

How to detect it

Review kernel logs for oops or panic messages referencing mt76_connac2_mac_write_txwi_80211; correlate any wireless frame handling anomalies with local process activity.

What your security team should do

  • Prioritize kernel updates on any system using MediaTek mt76 Wi-Fi hardware
  • Restrict local user access on multi-tenant or exposed Linux hosts until patched
  • Include the mt76 driver in routine kernel vulnerability scanning and patch automation

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt76_connac2_mac_write_txwi_80211 in order to avoid a possible oob access. [fix check to also cover mgmt->u.action.u.addba_req.capab, correct Fixes tag]

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities