Executive brief
A vulnerability was identified in the Linux kernel's MediaTek Wi-Fi driver (mt7925) that could allow an attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when the system scans for nearby wireless networks, specifically those using the 6GHz band. An attacker within wireless range could exploit this flaw to disrupt network operations or compromise the affected device.
Technical details
An off-by-one error (CWE-193) exists in the mt7925_mcu_hw_scan() function within drivers/net/wireless/mediatek/mt76/mt7925/mcu.c. The vulnerability is caused by an incorrect comparison operator ('>' instead of '>=') when validating the number of BSSIDs against the MT7925_RNR_SCAN_MAX_BSSIDS constant. This allows an out-of-bounds access to the ssid->ssids[] and sreq->ssids[] arrays. An attacker within radio range could potentially trigger this during a 6GHz RNR scan to cause a kernel panic (DoS) or achieve arbitrary code execution. The issue has been patched in the stable Linux kernel tree.
Affected products
- Linux Linux Kernel 6.16, 6.16.1, 6.17
Timeline
- 2025-08-19: disclosed
- 2025-08-19: advisory
- 2025-08-15: patched