EUVD-2026-76258
GHSA-gmwf-mx64-6gvq
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires controlling mt7996 MCU firmware (supply chain or privileged local flash), so AV:L, AC:H, PR:H; OOB kernel heap write carries full C/I/A impact if conditions are met.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr, a device-controlled __le32) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past eeprom.data.
Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.
AnalysisAI
Out-of-bounds write in the Linux kernel mt76/mt7996 WiFi driver allows a malicious or malfunctioning MediaTek mt7996 chip to corrupt kernel heap memory. The vulnerability exists in mt7996_mcu_get_eeprom(), which derives a destination offset into dev->mt76.eeprom.data from a device-controlled field (event->addr, a __le32 in the MCU response) without bounding that offset before performing the EFUSE/EXT block copy. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that (1) the target system has a MediaTek mt7996 WiFi 7 adapter physically installed and the mt7996e kernel driver loaded; (2) the MCU firmware on that adapter is malicious or has been compromised - either via supply-chain attack on the hardware unit or via a local privileged operation that flashes modified firmware to the chip. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 8.8 (AV:A/AC:L/PR:N/UI:N) significantly overstates realistic risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 7.2.4 or 7.3-rc1, both of which contain the fix that rejects MCU responses whose event->addr would place the EFUSE copy destination outside the bounds of eeprom.data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all systems using MediaTek mt7996 WiFi hardware to assess organizational exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today