Cloudanix VulnDB

CVE-2026-23363

High · 7.1

CVSS

7.1

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in certain Linux wifi hardware drivers could let an attacker on the same computer read or damage internal memory, potentially crashing the system or exposing data.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing length validation on 802.11 management frames before reading fields in mt7925_mac_write_txwi_80211 allows out-of-bounds kernel memory access in the mt7925 wifi driver.

Why it matters to the business

Systems using mt7925 hardware may experience kernel crashes, memory corruption, or information disclosure, leading to downtime, data exposure, and potential service disruption on affected Linux devices.

How an attack unfolds

An attacker with local access crafts or supplies a short 802.11 management frame that reaches mt7925_mac_write_txwi_80211; the missing bounds check then reads past the frame buffer, enabling memory corruption that can be leveraged for denial of service or limited information leaks.

How to fix it

Apply the upstream kernel patch that adds the frame-length check before accessing management fields; rebuild and deploy the updated kernel image on all affected systems; monitor vendor backports for distribution kernels.

How to confirm the fix worked

Confirm the presence of the length check in mt7925_mac_write_txwi_80211 in the running kernel source or binary; test with short management frames to verify no oob access occurs; review dmesg and kernel logs for related warnings after upgrade.

Typical attack path

  1. Obtain local access or control over transmitted 802.11 frames on an mt7925-equipped system
  2. Transmit a deliberately short management frame that bypasses normal length checks
  3. Trigger mt7925_mac_write_txwi_80211 with the undersized frame
  4. Read or corrupt adjacent kernel memory via the resulting out-of-bounds access

How to detect it

Review kernel logs for oops or panic messages referencing mt7925_mac_write_txwi_80211; inspect wifi driver stack traces for out-of-bounds accesses; correlate with processes that generate management frames.

What your security team should do

  • Prioritize kernel updates containing the mt7925 length-check fix on all mt7925 hardware
  • Restrict local access and wifi frame injection capabilities until patched
  • Monitor EPSS and exploit maturity indicators for any future increase in risk

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt7925_mac_write_txwi_80211 in order to avoid a possible oob access.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities