Executive brief
The Linux kernel's mt76 WiFi driver for MT7921S devices has a memory safety bug in its SDIO host interface handling. When SDIO operations require memory alignment padding of up to 511 bytes, the driver may allocate insufficient buffer space, causing it to read and write beyond allocated memory. This can lead to system crashes, data corruption, or potentially allow local attackers to gain elevated privileges.
Technical details
This is a slab-out-of-bounds vulnerability in the mt76 WiFi driver's SDIO host layer. The root cause is that the driver allocates socket buffers (skb) without accounting for the additional 511 bytes that SDIO operations may require for bus-level alignment. When the tailroom is insufficient, memory operations in sg_copy_buffer overflow into adjacent kernel heap allocations. The vulnerability is triggered during firmware upload and firmware operations, exploitable by local code with ability to trigger WiFi driver initialization. KASAN detects reads/writes 0 bytes beyond a 2048-byte kernel allocation. The fix increases skb allocation size to accommodate SDIO alignment requirements.
Affected products
- Linux Linux kernel through 6.1.0-rc5 and possibly later
Timeline
- 2025-12-24: disclosed