Executive brief
The Linux kernel's MediaTek MT76 WiFi driver contains an out-of-bounds memory access vulnerability in the transmit power calculation routine. A malicious or malfunctioning WiFi device could trigger this flaw to crash the kernel or potentially execute arbitrary code, disrupting network connectivity or compromising system stability.
Technical details
The vulnerability is an out-of-bounds (OOB) access in the mt76x0_phy_get_target_power() function in the MT76 WiFi driver. After a prior refactoring commit simplified the rate_power structure, the code incorrectly indexed into the vht[] array without bounds checking: it used tx_rate (0-9) directly as an index into an array sized for only 2 elements (indices 0-1). The fix adds proper conditional logic to use ht[0-7] for rates 0-7 and vht[0-1] for rates 8-9. Attack vector is network-adjacent (requires proximity to a malicious WiFi device), and the vulnerability may allow denial of service or information disclosure. A patch has been committed to the Linux kernel mainline.
Affected products
- Linux Linux Kernel drivers/net/wireless/mediatek/mt76 (MT76 WiFi driver)
Timeline
- 2025-10-04: disclosed
- 2022-12-09: patched: Fix committed mainline in commit 6e1abc51c945663bddebfa1beb9590ff5b250eb7