CVE-2026-74324
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925_tm_query(), the response skb from mt76_mcu_send_and_get_msg() is used in a memcpy without validating its length: memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN); where MT7925_EVT_RSP_LEN is 512. If the firmware returns a response shorter than 520 bytes (8 + 512), this reads beyond the skb data buffer. The over-read data is then returned to userspace via nla_put() in mt7925_testmode_dump(). Add a length check before the memcpy to ensure the skb contains sufficient data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74324
EUVD
EUVD-2026-59471

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer over-read vulnerability in the Linux kernel's mt76 Wi-Fi driver for MediaTek MT7925 devices. The issue occurs in the testmode query function where a response from the firmware is copied without checking its length. If the response is too short, the code reads past the end of the allocated buffer, potentially exposing kernel memory to userspace.

Detection Guidance

This vulnerability is specific to the Linux kernel's mt76 WiFi driver for MediaTek MT7925 chipsets. Detection requires checking kernel logs for crashes or memory corruption related to mt76 or mt7925 modules. Use commands like dmesg | grep mt76 or journalctl -k | grep mt76 to inspect driver logs.

Impact Analysis

An attacker with local access could exploit this to read sensitive kernel memory, leading to information disclosure. This might allow them to bypass security mechanisms or gain elevated privileges on the system. Remote exploitation is unlikely as it requires local access to trigger the vulnerable code path.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this issue. If immediate patching is not possible, disable the affected mt76 or mt7925 WiFi modules by blacklisting them in the kernel.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74324. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart