CVE-2026-80935
High · 8.8CVSS
8.8
EPSS
0.4%
Published
Sep 11, 2026
CISA due date
—
Cloudanix analysis
A bug in Linux wireless driver code could let a nearby attacker take over a computer by sending bad data from a Wi-Fi device.
- Exploitation
- Adjacent Network
- Attacker needs
- None
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Buffer Overflow
- Remediation
- Patch
- Effort
- Low
- Patch risk
- Low
What it actually does
The mt76 mt7996 driver accepts an unvalidated __le32 address from an MCU response and uses it as the destination offset for an EFUSE/EXT EEPROM block copy into dev->mt76.eeprom.data without clamping the offset, allowing an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes.
Why it matters to the business
A compromised or malicious wireless device can corrupt kernel memory on the host, potentially leading to system instability, privilege escalation, or full host compromise on systems using affected MediaTek Wi-Fi hardware.
How an attack unfolds
An attacker with the ability to influence or replace the device firmware causes the MCU to reply with an address that points outside the allocated eeprom.data buffer; the driver then performs the copy, overwriting adjacent kernel structures and enabling further exploitation.
How to fix it
Update the Linux kernel to a version containing the upstream fix that validates the reported address lies inside eeprom.data before performing the copy; rebuild and deploy the updated kernel on all affected systems.
How to confirm the fix worked
Confirm the patched driver contains the address-range check before the destination pointer is derived; monitor for absence of out-of-bounds write reports in kernel logs after applying the update.
Typical attack path
- Obtain or modify a compatible mt7996 device to control MCU responses
- Trigger mt7996_mcu_get_eeprom() from the host driver
- Supply a malicious event->addr value outside eeprom.data bounds
- Trigger the unbounded memcpy to corrupt kernel memory
- Leverage the resulting memory corruption for code execution or denial of service
How to detect it
Inspect kernel logs for oops or warning messages originating from mt76 or mt7996 EEPROM handling routines; look for unexpected writes near eeprom.data structures during device initialization.
What your security team should do
- Prioritize kernel updates for any systems exposing mt7996 hardware on untrusted networks
- Apply the fix within standard change windows given the 18-day publication window and high CVSS
- Review wireless driver usage across fleets and schedule testing of the patched kernel
- Monitor vendor advisories for backported fixes in distribution kernels
The record
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr, a device-controlled __le32) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past eeprom.data. Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|