Executive brief
A vulnerability exists in the Linux kernel driver for Mediatek Wi-Fi 7 devices. An attacker within wireless range could potentially cause system instability or memory corruption by sending specific network traffic that the driver fails to validate correctly. This could lead to a complete system crash or unauthorized access to system memory, impacting the reliability and security of the affected device.
Technical details
A vulnerability in the mt76 wireless driver, specifically within the mt7996 module, stems from a missing validation check for Wireless Client ID (wcid) entries during receive (RX) processing. The function mt7996_rx_get_wcid fails to verify if a wcid entry is a valid station entry before passing it to subsequent RX functions. When a global or non-station wcid is processed, the driver performs a pointer cast using container_of to 'struct mt7996_sta_link', leading to potential memory corruption in the wcid array. This can be triggered by an unauthenticated attacker on the adjacent network (Wi-Fi range). The issue has been patched in Linux kernel versions 6.16.6 and 6.17.
Affected products
- Linux Linux Kernel 6.15 to 6.16.6
Timeline
- 2025-10-01: disclosed
- 2025-10-01: advisory
- 2025-09-09: patched