CVE-2026-80937

Received Received - Intake

Buffer Overflow in Linux Kernel mt76 WiFi Driver

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data buffer at the offset reported by the MCU response (res->addr, a device-controlled __le32) without checking it against the buffer size. A malicious or malfunctioning device can report an arbitrary address and drive a 16-byte out-of-bounds write past eeprom.data. Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-80937

EUVD

EUVD-2026-76260

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's mt76 Wi-Fi driver, specifically affecting the mt7915 device. A malicious or malfunctioning device can send an invalid address that causes the driver to write 16 bytes beyond the allocated buffer for EEPROM data. The issue occurs in the mt7915_mcu_get_eeprom() function when copying data from the device's EFUSE block without validating the address.

Detection Guidance

This vulnerability involves a potential out-of-bounds write in the Linux kernel's mt76 driver for mt7915 devices. Detection requires checking if your system uses the affected driver version. Inspect loaded kernel modules with lsmod | grep mt76 and verify driver versions. No direct commands detect exploitation but monitoring for crashes or unusual behavior in wireless drivers may help.

Impact Analysis

This vulnerability could allow an attacker with access to the Wi-Fi network to cause a denial of service by crashing the system or potentially execute arbitrary code with kernel privileges. Systems using affected mt7915 Wi-Fi devices may experience instability or security breaches if exploited.

Mitigation Strategies

Update your Linux kernel to the latest patched version immediately. If using a distribution kernel, apply available security updates. For custom kernels, ensure the fix for CVE-2026-80937 is included. Disable the mt7915 driver if not required by blacklisting the module.

Hi! I’m here to help you understand CVE-2026-80937. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70