Cloudanix VulnDB

CVE-2026-80933

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain wireless network drivers can let a logged-in user feed a bad file that makes the system read memory it should not, risking crashes or leaks.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Missing length validation on default EEPROM firmware allows a truncated file to trigger an out-of-bounds read when the mt7996 driver parses or copies the buffer during variant validation or fallback handling.

Why it matters to the business

Local users on systems with mt7996 wireless hardware can trigger crashes, kernel panics, or limited information disclosure, potentially disrupting wireless connectivity and requiring system restarts.

How an attack unfolds

An attacker with local access supplies or replaces the default EEPROM firmware image with a deliberately shortened file; the driver loads it without size checks, causing reads past the allocated buffer during validation or copy operations and resulting in memory corruption.

How to fix it

Update the Linux kernel to a version containing the mt76 driver fix that rejects EEPROM firmware files shorter than MT7996_EEPROM_SIZE before parsing or copying; rebuild and reboot with the patched kernel; verify the mt7996 driver is loaded from the updated source.

How to confirm the fix worked

Confirm the running kernel contains the commit that adds the length check against MT7996_EEPROM_SIZE; inspect driver source or dmesg for the validation message on firmware load; test with an intentionally truncated EEPROM image to ensure rejection occurs.

Typical attack path

  1. Obtain local access or execute code on the target system
  2. Place or modify the mt7996 default EEPROM firmware file to be shorter than MT7996_EEPROM_SIZE
  3. Trigger driver initialization or firmware loading for the mt7996 device
  4. Driver performs unchecked read during variant validation or fallback copy, leading to out-of-bounds access

How to detect it

Review kernel logs and dmesg for mt76 or mt7996 oops/panic entries around firmware load times; correlate with attempts to load non-standard EEPROM images via /lib/firmware or module parameters; no remote indicators exist.

What your security team should do

  • Prioritize kernel updates on all systems using mt7996 hardware within the next patch cycle
  • Restrict local user access to firmware directories used by the mt76 driver
  • Monitor for unusual kernel oops or wireless driver crashes in system logs
  • Review wireless hardware inventory to identify affected mt7996 devices

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during variant validation or the fallback copy. Reject files shorter than MT7996_EEPROM_SIZE before parsing or copying the firmware.

Affected packages

Ecosystem Package Introduced Fixed