Executive brief
A vulnerability was identified in the Linux kernel's MediaTek Wi-Fi driver (mt7996) that could allow an attacker to cause a system crash or potentially access sensitive information. This issue occurs during wireless data transmission when certain network link identifiers are not properly validated. The flaw affects devices using specific MediaTek wireless chipsets running affected versions of the Linux operating system.
Technical details
An out-of-bounds (OOB) access vulnerability exists in the mt7996_tx() routine within the mt76 wireless driver. The issue is triggered when the link_id is set to IEEE80211_LINK_UNSPECIFIED, leading to improper array indexing or pointer dereferencing. An attacker within wireless range could potentially exploit this to cause a kernel panic (DoS) or read sensitive kernel memory. The fix involves adding bounds checking for the link_id and ensuring a valid link structure is used during transmission. Patches have been released for stable kernel branches including 6.15.10 and 6.16.1.
Affected products
- Linux Linux Kernel 6.15 to 6.15.10, 6.16 to 6.16.1
Timeline
- 2025-08-19: disclosed
- 2025-08-19: advisory
- 2025-07-07: patched