Executive brief
A vulnerability was identified in the Linux kernel's MediaTek Wi-Fi driver (mt7921) that can cause the system to enter an infinite loop during hardware initialization. This occurs when the driver processes specific country-based power settings, potentially leading to a system hang or failure to enable Wi-Fi services. The issue primarily impacts the availability of wireless networking on affected devices.
Technical details
A buffer length underflow exists in the `__mt7921_mcu_set_clc` function within `drivers/net/wireless/mediatek/mt76/mt7921/mcu.c`. The variable `buf_len` is used to track remaining data while iterating through country power rules; however, if the calculated `offset` exceeds the remaining `buf_len`, an underflow occurs. Because `buf_len` is an unsigned type, this results in a very large value, causing an almost infinite loop or memory access issues. This typically results in a kernel hang or driver initialization failure. Patches have been released across multiple stable kernel branches to include a bounds check before updating the buffer offset.
Affected products
- Linux Linux Kernel mt76 mt7921 driver
Timeline
- 2025-10-09: other: Patch authored by MediaTek engineers
- 2026-05-28: disclosed: CVE published and NVD record created
References
- https://git.kernel.org/stable/c/0aa63d33742b805d1a218d18d12b983cce4b2f7b
- https://git.kernel.org/stable/c/5373f8b19e568b5c217832b9bbef165bd2b2df14
- https://git.kernel.org/stable/c/90cc573fd2f46ddbc2c329e7814b5ba3deb7b939
- https://git.kernel.org/stable/c/a0111847f0b4f6023f6dd320114697514e024ba3
- https://git.kernel.org/stable/c/e451c325b000b9a0081fd93bc6d103d6943d4b55