EUVD-2026-76260
GHSA-c9p9-v2fp-rr7g
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent vector correct for device-bus attack; AC:H because malicious or firmware-modified MT7915 hardware must be present; PR:N as no host-side privileges are required.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data buffer at the offset reported by the MCU response (res->addr, a device-controlled __le32) without checking it against the buffer size. A malicious or malfunctioning device can report an arbitrary address and drive a 16-byte out-of-bounds write past eeprom.data.
Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.
AnalysisAI
Unchecked device-controlled address in the mt7915 WiFi driver's EEPROM copy path allows a malicious or compromised MT7915 MCU to trigger a 16-byte out-of-bounds heap write in the host kernel. The driver's mt7915_mcu_get_eeprom() trusts the MCU response field res->addr (a device-supplied __le32) as a destination offset into eeprom.data without validating it against the buffer's bounds, enabling arbitrary kernel heap corruption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Linux host has an MT7915-based WiFi adapter physically installed (PCIe card, M.2 card, or USB dongle) and the mt7915/mt76 kernel module loaded. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS vector (AV:A/AC:L/PR:N/UI:N) scores 8.8, but the adjacent-network vector and low complexity overstate ease of exploitation for a hardware-firmware trust-boundary attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update the Linux kernel to 6.18.50, 7.2.4, or 7.3-rc1 (or a distribution kernel incorporating the upstream commits 44b5adfe, 5fdaf701, or 5f48b0d7 as appropriate for the running stable branch). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems deployed with MT7915-based wireless adapters and assess their network isolation status; mark affected systems for urgent patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today