What is the CVSS score of CVE-2026-23325?

CVE-2026-23325 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-23325?

Yes, a patch is available for CVE-2026-23325. Update the affected software to the latest version immediately.

Linux CVE-2026-23325

EUVD-2026-15278 HIGH

Out-of-bounds Read (CWE-125)

2026-03-25 Linux

GHSA-ghwv-vcf8-g6g9

Buffer Overflow Linux Information Disclosure Red Hat

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

SUSE

5.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 21:27 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 21:27 NVD

7.1 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 25, 2026 - 10:45 euvd

EUVD-2026-15278

Analysis Generated

Mar 25, 2026 - 10:45 vuln.today

CVE Published

Mar 25, 2026 - 10:27 nvd

N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()

Check frame length before accessing the mgmt fields in mt7996_mac_write_txwi_80211 in order to avoid a possible oob access.

AnalysisAI

An out-of-bounds (OOB) memory access vulnerability exists in the Linux kernel's MediaTek MT7996 WiFi driver (mt76) within the mt7996_mac_write_txwi_80211() function. The vulnerability occurs when the function accesses management frame fields without first validating the frame length, potentially allowing information disclosure or denial of service on systems using affected MT7996 hardware. Multiple stable kernel patches are available across several kernel versions, indicating the issue has been actively remediated in the upstream Linux project.

Technical ContextAI

The vulnerability resides in the mt76 WiFi driver stack, specifically in the MediaTek MT7996 chipset implementation. The affected function mt7996_mac_write_txwi_80211() is responsible for writing transmit word index (TXWI) information for 802.11 management frames. The root cause is a missing bounds check (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) before accessing management frame fields from a skb (socket buffer) structure. The mt76 driver is part of the Linux kernel networking subsystem (CPE: cpe:2.3:a:linux:linux), which affects all distributions and embedded systems running vulnerable kernel versions. Without proper frame length validation, an attacker who can craft malicious 802.11 frames could trigger out-of-bounds memory reads, potentially leaking sensitive kernel memory or causing kernel panics.

RemediationAI

Apply the upstream Linux kernel patch by upgrading to a kernel version that includes one of the five referenced remediation commits. Users should check with their Linux distribution for backported patches in their stable kernel update channels. For systems unable to immediately upgrade, network-level mitigations include: disabling or limiting 802.11 management frame processing when not required, restricting WiFi radio reception to known secure networks, and implementing strict wireless network access controls to prevent reception of crafted frames from untrusted sources. Distributions should prioritize backporting the fix to all supported LTS (Long-Term Support) kernel branches, particularly those powering embedded systems and wireless infrastructure. Monitor kernel.org and your distribution's security advisories for official patched releases and apply updates at the earliest maintenance window.

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2016-1646 HIGH POC

8.8

CVE-2025-5777 HIGH POC

7.5

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2017-11882 HIGH POC

7.8

CVE-2010-3333 HIGH POC

7.8

Vendor StatusVendor

Debian

linux

Release	Status	Fixed Version	Urgency
bullseye	not-affected	-	-
bullseye (security)	fixed	5.10.251-1	-
bookworm	not-affected	-	-
bookworm (security)	fixed	6.1.164-1	-
trixie	vulnerable	6.12.73-1	-
trixie (security)	vulnerable	6.12.74-2	-
forky, sid	fixed	6.19.8-1	-
(unstable)	fixed	6.19.8-1	-

SUSE

Severity: Medium

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

CVE-2026-23325 vulnerability details – vuln.today

Back

Linux CVE-2026-23325

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-125 – Out-of-bounds Read

Same technique Buffer Overflow

Vendor StatusVendor

Debian

SUSE

Share

External POC / Exploit Code