Cloudanix VulnDB

CVE-2026-98159

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Sep 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in Linux wireless firmware handling could let someone with local access crash affected computers or damage memory on certain Wi-Fi chips.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability allows a malformed firmware image to cause out-of-bounds memory access in the mt7921 wireless driver by supplying invalid region counts or record lengths for CLC data, leading to pointer miscalculations, non-advancing loops, or indexing past buffer ends.

Why it matters to the business

Local attackers or compromised firmware loading could trigger crashes or memory corruption on Linux systems using MediaTek mt7921 WiFi hardware, resulting in denial of service and potential system instability for wireless-enabled devices.

How an attack unfolds

An attacker with local access supplies a crafted firmware binary containing invalid CLC region tables to the mt76 driver for mt7921; during firmware loading the unvalidated counts and lengths cause the region pointer to precede the buffer or index phy->clc out of bounds.

How to fix it

Apply the upstream kernel patch that validates CLC firmware table and record bounds before use. Monitor Linux distribution updates for mt76/mt7921 driver fixes and deploy them promptly on affected kernels.

How to confirm the fix worked

Inspect the mt7921 CLC loading code for added bounds checks on region count and record lengths; attempt to load intentionally malformed firmware and confirm the driver rejects it without out-of-bounds access.

Typical attack path

  1. Obtain local access or ability to influence firmware loading on the target system
  2. Prepare and supply a malformed CLC firmware image to the mt7921 driver
  3. Trigger the firmware loader to process the image and dereference invalid records

How to detect it

Review kernel logs (dmesg, syslog) for mt7921 or mt76 driver warnings, oops, or CLC-related errors during firmware loading; correlate with unexpected firmware update attempts.

What your security team should do

  • Prioritize kernel updates containing the CLC validation fix on all systems with mt7921 hardware
  • Limit untrusted local users' ability to load custom firmware where feasible
  • Review wireless driver logs after updates to confirm stable operation

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: validate CLC firmware records The CLC region is supplied by firmware, but the loader trusts the region count and each record length. A malformed image can make the region table pointer precede the firmware buffer, make the record loop fail to advance, or index phy->clc past its end. Validate the table and record bounds before dereferencing or copying.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities