CVE-2026-80935
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr, a device-controlled __le32) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past eeprom.data. Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.
How to fix
- Linux Linux4892be1ef0bbe6db6b13bf46cb79b6706bb5b214, 388f471ca4758f644394b681ce97677a4d0e772c, 9e5abb5e2ade0b6fd0e47209711115d47a255176, 6be59da2063d5b3522bfde8aae0487ec095eb384, 13b3c29a782033ce4a230be9e5618032813dbcd4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 98686cd21624c75a043e96812beadddf4f6f48e5 ≤ v < 4892be1ef0bbe6db6b13bf46cb79b6706bb5b214, 98686cd21624c75a043e96812beadddf4f6f48e5 ≤ v < 388f471ca4758f644394b681ce97677a4d0e772c, 98686cd21624c75a043e96812beadddf4f6f48e5 ≤ v < 9e5abb5e2ade0b6fd0e47209711115d47a255176, 98686cd21624c75a043e96812beadddf4f6f48e5 ≤ v < 6be59da2063d5b3522bfde8aae0487ec095eb384, 98686cd21624c75a043e96812beadddf4f6f48e5 ≤ v < 13b3c29a782033ce4a230be9e5618032813dbcd4, 6.2 | 4892be1ef0bbe6db6b13bf46cb79b6706bb5b214, 388f471ca4758f644394b681ce97677a4d0e772c, 9e5abb5e2ade0b6fd0e47209711115d47a255176, 6be59da2063d5b3522bfde8aae0487ec095eb384, 13b3c29a782033ce4a230be9e5618032813dbcd4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.