Executive brief
The Linux kernel's MT7601U WiFi driver contains an integer underflow vulnerability in packet reception that can be triggered by a malicious USB device or network packet. An attacker can manipulate packet data to bypass safety checks and cause a null pointer dereference, crashing the kernel and disrupting system availability.
Technical details
The vulnerability is an integer underflow in the mt7601u_rx_process_seg() function where the variable 'seg_len' can underflow due to insufficient validation of the 'dma_len' field from incoming URB packets. This underflow bypasses boundary checks in mt7601u_rx_skb_from_seg(), allowing a null pointer to be dereferenced when processing the packet frame. The vulnerability requires either a malicious USB device or crafted network packets on an adjacent network, and results in a kernel panic (denial of service). The fix validates that 'dma_len' is greater than 'min_seg_len' before processing. A patch has been committed to the Linux kernel.
Affected products
- Linux Linux kernel 5.14.0 and likely other versions
Timeline
- 2025-10-07: disclosed