Executive brief
The Linux kernel's mt76 driver for MediaTek MT7921 WiFi adapters contains a buffer overflow vulnerability in its USB SDIO transmission path. When bridging a MT7921 wireless interface with an Ethernet network, attackers or misconfigured systems can trigger kernel panics and potential code execution. This affects systems combining MT7921AU USB WiFi adapters with Ethernet interfaces, such as Raspberry Pi and Intel Atom-based devices.
Technical details
The vulnerability is a buffer overflow in mt7921_usb_sdio_tx_prepare_skb() which blindly assumes sufficient headroom exists in network buffers (sk_buff structures) for prepending SDIO headers without validation. When skbs originate from the receive path of bridged interfaces (e.g., Ethernet), they may have insufficient headroom, causing skb_push() to overflow the buffer. The attack vector requires network access and occurs when bridging heterogeneous network interfaces. Exploitation results in kernel panic (denial of service) and potentially arbitrary code execution in kernel context. The fix involves adding skb_cow_head() to ensure adequate headroom before header prepending, and patches are available in upstream Linux kernel.
Affected products
- Linux Linux kernel 6.1.24 and earlier (mt7921 driver)
Timeline
- 2025-12-09: disclosed
- 2023: advisory: CVE-2023-53785