EUVD-2026-76256
GHSA-2pcp-qx27-wf69
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Placing a truncated firmware file in /lib/firmware requires root (PR:H); specific hardware and driver-reload conditions make AC:H; no write impact confirmed beyond primary OOB read.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: validate default EEPROM firmware size
The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during variant validation or the fallback copy.
Reject files shorter than MT7996_EEPROM_SIZE before parsing or copying the firmware.
AnalysisAI
Out-of-bounds memory read in the Linux kernel mt76/mt7996 Wi-Fi driver allows a local attacker with ability to supply a truncated EEPROM firmware file to trigger kernel memory disclosure or crash during driver initialization. The driver unconditionally copies and validates the default EEPROM firmware without first checking its length against the expected MT7996_EEPROM_SIZE constant, so a file shorter than that threshold causes reads past the end of the allocated firmware buffer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a Linux kernel version between 6.2 and the fix commits (6.18.50 / 7.2.4 / 7.3-rc1); (2) a MediaTek mt7996 (Wi-Fi 7) hardware adapter present and the mt7996 kernel module loaded; (3) the ability to place a file shorter than MT7996_EEPROM_SIZE bytes at the EEPROM firmware path read by the driver - on nearly all distributions this requires root or equivalent CAP_DAC_OVERRIDE with write access to /lib/firmware. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) overstates real-world risk on multiple axes. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux 6.18.50, 7.2.4, or 7.3-rc1, which contain the fix that rejects EEPROM firmware blobs shorter than MT7996_EEPROM_SIZE before any parsing or copy. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems using MT7996 Wi-Fi hardware by querying driver status (lsmod | grep mt76) and checking hardware inventory for MT7996 chipsets. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today