CVE-2026-46136

What it actually does

This flaw is an integer/buffer length underflow in the Linux kernel mt76 mt7921 Wi-Fi driver while parsing CLC country power-setting data. Under certain power-table conditions, the remaining buffer length can wrap below zero and become a very large value, causing the driver to continue iterating beyond the intended bounds. The observed outcomes include an almost infinite loop, invalid wireless power configuration, and mt7921 driver initialization failure. Because this occurs in kernel driver code, successful exploitation can affect kernel availability and may create broader confidentiality or integrity risk depending on how out-of-bounds parsing behaves on a given build and platform.

Why it matters to the business

Systems using MediaTek mt7921 Wi-Fi hardware with affected Linux kernels may experience wireless driver initialization failures, connectivity loss, kernel instability, or local denial of service. The issue requires local access and currently has no known public exploit or KEV listing, and the EPSS score is low, so broad internet-scale exploitation is unlikely. However, affected laptops, endpoints, embedded Linux devices, and appliances that depend on this Wi-Fi chipset could suffer operational disruption if the driver is triggered into the vulnerable path.

How an attack unfolds

An attacker first needs local access to a Linux system running an affected kernel with the mt76 mt7921 Wi-Fi driver in use or loadable. The attacker then attempts to trigger driver initialization or regulatory/CLC power-table parsing under conditions that cause the CLC buffer length calculation to underflow. Once the underflow occurs, the driver may iterate far beyond the expected bounds, apply invalid power settings, or fail to initialize. The most realistic exploitation outcome is local denial of service through Wi-Fi driver failure or system instability; privilege escalation or data exposure would depend on whether the underflow can be shaped into reliable out-of-bounds kernel memory access on a specific kernel build.

How to fix it

Upgrade to a Linux kernel release or vendor backport that includes the mt76 mt7921 fix for the CLC buffer length underflow. Because no exact fixed versions were provided, use the security advisory from the relevant Linux distribution or device vendor and deploy the first kernel package that explicitly includes the fix for this issue. Reboot after installing the patched kernel so the fixed driver is loaded. Where immediate patching is not possible, reduce exposure by disabling or blacklisting the mt7921/mt76 driver on systems that do not require the affected Wi-Fi hardware, preventing untrusted local users from loading kernel modules or changing wireless/regulatory settings, and favoring wired networking or unaffected wireless adapters until patched.

How to confirm the fix worked

Confirm the running kernel is the patched vendor build, not only that the package is installed. Validate with commands such as `uname -a`, the distribution package manager, and vendor security advisory metadata. Confirm the affected driver is either updated or not loaded using `lsmod | grep -E 'mt7921|mt76'`, `modinfo mt7921e`, `modinfo mt7921u`, and kernel package changelogs. Reboot into the fixed kernel and verify that mt7921 initializes cleanly with `dmesg` or `journalctl -k`, with no repeated mt7921 initialization failures, CLC parsing errors, firmware reset loops, or wireless device disappearance. If mitigation is used instead of patching, confirm blacklist files or module-loading policy prevent the vulnerable module from loading after reboot.

Typical attack path

1. Obtain local access to a Linux system that uses or can load the mt76 mt7921 Wi-Fi driver.
2. Confirm the affected MediaTek mt7921 Wi-Fi device and vulnerable kernel/driver are present.
3. Trigger mt7921 driver initialization, reload, reset, regulatory update, suspend/resume, or another path that causes CLC country power-setting data to be parsed.
4. Cause the CLC buffer length calculation to underflow under the vulnerable power-table conditions.
5. Induce an almost infinite loop, invalid power setting, driver initialization failure, Wi-Fi outage, or kernel instability.

How to detect it

Post-exploitation detection is difficult because the vulnerability is triggered inside kernel driver initialization/parsing paths and may not leave a unique artifact. Review kernel logs, system journals, endpoint telemetry, and audit logs for signs of mt7921 driver instability or deliberate triggering. Relevant sources include `journalctl -k`, `/var/log/kern.log`, `/var/log/messages`, `/var/log/syslog`, auditd logs, EDR process telemetry, module load/unload events, and crash dumps. Look for repeated mt7921 or mt76 initialization failures, firmware reset loops, soft lockups, invalid regulatory or power-setting messages, Wi-Fi device disappearance, unexpected `modprobe`/`rmmod` activity involving mt7921/mt76 modules, repeated suspend/resume or rfkill toggling, and local users running commands that manipulate Wi-Fi regulatory state or force driver reloads. Correlate kernel instability with local interactive sessions or automation launched shortly before the messages appeared.

• mt7921
• mt76
• mt7921e
• mt7921u
• modprobe mt7921e
• modprobe mt7921u
• modprobe mt76
• rmmod mt7921e
• rmmod mt7921u
• rmmod mt76
• /sys/module/mt7921e
• /sys/module/mt7921u
• /sys/module/mt76
• /etc/modprobe.d/blacklist-mt7921.conf
• firmware restart
• driver initialization failed
• init failed
• invalid power setting
• country power
• CLC
• clc
• soft lockup
• watchdog: BUG: soft lockup
• iw reg set
• rfkill block wifi
• rfkill unblock wifi

What your security team should do

• Inventory Linux endpoints, laptops, embedded systems, and appliances for MediaTek mt7921 Wi-Fi hardware and loaded mt76/mt7921 kernel modules.
• Prioritize patching systems where local users, shared shell access, kiosk users, containers with elevated host interaction, or untrusted workloads can influence driver state or trigger module reload/reset paths.
• Deploy the vendor-patched kernel and reboot affected systems; verify the running kernel version after reboot.
• Where patching is delayed, disable or blacklist the affected mt7921 driver on systems where Wi-Fi is not business-critical.
• Monitor kernel logs for mt7921 initialization failures, repeated firmware resets, regulatory/CLC errors, soft lockups, or unexplained Wi-Fi outages.
• Treat any suspicious local activity involving repeated driver reloads, rfkill toggling, regulatory-domain changes, or suspend/resume loops as potentially relevant until the system is patched.