CVE-2026-23325

What it actually does

Out-of-bounds memory access in the mt7996_mac_write_txwi_80211 function when processing 802.11 management frames without first validating frame length, allowing reads or writes beyond allocated buffers in the Linux kernel wifi driver.

Why it matters to the business

Systems using MediaTek mt7996 wireless hardware may experience kernel crashes, memory corruption, or information leaks that disrupt wireless connectivity and require reboots or patches, with low but non-zero exploitation probability indicated by EPSS trends.

How an attack unfolds

An attacker with local access crafts or injects 802.11 management frames that lack proper length checks, triggering the vulnerable code path in mt7996_mac_write_txwi_80211 to access memory outside expected bounds.

How to fix it

Update the Linux kernel to a version containing the frame length check fix in mt7996_mac_write_txwi_80211; monitor upstream commits for mt76/mt7996 and apply distro backports when available since no fixed versions are listed.

How to confirm the fix worked

Confirm kernel source contains the length check before mgmt field access in mt7996_mac_write_txwi_80211; test with malformed short management frames to ensure no OOB access occurs.

Typical attack path

1. Obtain local access on a Linux system with mt7996 hardware
2. Trigger or inject 802.11 management frames into the wireless stack
3. Bypass missing frame length validation in mt7996_mac_write_txwi_80211
4. Cause OOB read/write leading to corruption or disclosure

How to detect it

Review kernel logs for oops or panic messages referencing mt7996_mac_write_txwi_80211 or mt76; inspect wireless frame processing paths for unexpected short management frames.

What your security team should do

• Prioritize kernel updates on systems with mt7996 hardware due to memory corruption family and CVSS 7.1
• Monitor EPSS trend for any increase beyond 0.0013
• Restrict local wireless frame injection capabilities where possible