Executive brief
The Mediatek MT7915 WiFi driver in the Linux kernel contains a buffer overflow vulnerability in its EEPROM initialization code. A malicious or malfunctioning wireless device can trigger an out-of-bounds memory write, potentially causing kernel crashes or enabling arbitrary code execution on systems using affected MT7915 wireless chipsets.
Technical details
The vulnerability exists in the mt7915_mcu_get_eeprom() function, which copies a 16-byte EFUSE block into the driver's eeprom.data buffer using an offset (res->addr) controlled by the device firmware. The function fails to validate that this offset is within the bounds of the eeprom.data buffer before performing the copy, allowing a malicious device to write 16 bytes past the end of the allocated buffer. The fix adds a bounds check that rejects responses with out-of-bounds addresses before deriving the destination pointer. This vulnerability requires physical/adjacent proximity to the affected wireless device and affects Linux kernel versions from the MT7915 driver's introduction through the patch date.
Affected products
- Linux Linux Kernel All versions from MT7915 driver introduction (v5.8+) through before patch commit 44b5adfe49499f53002737f5fe81d608c08122fc
Timeline
- 2026-09-11: disclosed: CVE-2026-80937 published
- 2026-06-25: patched: Fix committed upstream (commit 44b5adfe49499f53002737f5fe81d608c08122fc)
- 2026-09-07: patched: Fix backported to stable trees