Linux Kernel EUVD-2026-86990

Exploitation requires that the system (1) uses the mt76/mt7921 MediaTek Wi-Fi driver and (2) loads a malformed CLC firmware image whose region count or per-record length is attacker-controlled. The specific trigger is the CLC (country/location configuration) region parsing during firmware load, where the region-table pointer can be made to precede the firmware buffer, the record loop can fail to advance, or indexing can run past the end of phy->clc. Limiting factors: this is local-only (AV:L) and needs existing privileges (PR:L) sufficient to place or present a crafted firmware blob - a normal remote network attacker cannot reach this path. Systems without MediaTek MT7921 hardware or the mt7921 driver are not affected at all, which sharply constrains the real-world attack surface.

This is a low-to-moderate real-world priority despite being a memory-corruption bug. All exploitation signals point the same direction: the provided CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) describes a LOCAL (AV:L), already-privileged (PR:L) attacker achieving only an availability impact (A:H), with no confidentiality or integrity loss (C:N/I:N). EPSS is very low at 0.16% (4th percentile), the CVE is NOT on the CISA KEV list, and no public PoC is referenced - so there is no evidence of exploitation and no exploit code identified at time of analysis. There is one notable tension to verify: the CWE is CWE-787 (out-of-bounds write) and the description explicitly describes an OOB write primitive, yet the official vector scores I:N (no integrity impact). An OOB write into kernel memory can plausibly yield more than a crash, so the A:H-only scoring may understate worst-case impact - the realistic outcome remains a kernel panic/DoS, but defenders should treat the write primitive as potentially more than availability. Also note the affected 'product' per CPE is the entire Linux kernel (ubiquitous), but the actually-vulnerable code is the narrow mt76/mt7921 MediaTek Wi-Fi driver path, so the true exploitable population is far smaller than the CPE implies. Net: this is a legitimate kernel-hardening fix, not an urgent, widely-exploitable threat.

An attacker able to supply or replace the Wi-Fi firmware blob consumed by the mt7921 driver (e.g. a local privileged user tampering with the firmware image in /lib/firmware, or a malicious attached device presenting a crafted image) provides a malformed CLC region with a bogus region count or record length. During driver load the unvalidated table pointer precedes the firmware buffer or indexes past phy->clc, producing an out-of-bounds access that crashes the kernel. No public exploit code is identified, and the CVSS vector indicates this requires local access with existing privileges rather than remote delivery.