Executive brief
The Linux kernel's Mediatek mt7925 Wi-Fi driver contains a buffer over-read vulnerability in its testmode query handler. When the Wi-Fi firmware returns a response shorter than expected, the driver copies data beyond the buffer boundary and leaks this over-read data to user-space applications. An attacker who can control the firmware response or cause it to be truncated could potentially expose sensitive kernel memory.
Technical details
The vulnerability is a buffer over-read in the mt7925_tm_query() function within the mt76 wireless driver. The function uses memcpy to copy 512 bytes (MT7925_EVT_RSP_LEN) from a socket buffer (skb) without first validating that the buffer contains at least 520 bytes (8-byte offset + 512 bytes). If firmware returns a shorter response, memcpy reads beyond the buffer boundary. The over-read kernel memory is then returned to user-space via nla_put() in mt7925_testmode_dump(). The fix adds a length validation check before the memcpy operation to ensure the skb is sufficiently large, returning an error code if the length is insufficient.
Affected products
- Linux Linux kernel affected versions prior to patch c7369a00860a0704461d440e7c3bf9b49bfdbaee
Timeline
- 2026-08-15: disclosed
- 2026-06-09: patched: upstream patch committed