Executive brief
The Linux kernel's MT7996 Wi-Fi driver contains a buffer overflow vulnerability in beacon frame handling. When channel switch announcement (CSA) countdowns are active with multiple BSSID support, the driver fails to reserve sufficient memory, causing the beacon command to exceed its allocated buffer size and trigger a kernel panic that crashes the system.
Technical details
The vulnerability is a buffer overflow in the MT7996 wireless driver's beacon update code. The mt7996_mcu_beacon_cntdwn() function emits two TLV (Type-Length-Value) structures for countdown tracking (CSA countdown and CCA-abort BCC), but the MT7996_BEACON_UPDATE_SIZE macro only reserved space for one. When MBSSID (Multiple BSSID) is enabled with a near-maximum beacon template, the extra 8 bytes of the second TLV pushes the offload command past the MT7996_MAX_BSS_OFFLOAD_SIZE limit, triggering skb_over_panic(). The fix simply multiplies the reserved space for bss_bcn_cntdwn_tlv by 2 in the macro definition. No network interaction or authentication is required; a local attacker with the ability to trigger CSA countdown events can cause a denial of service.
Affected products
- Linux Linux kernel 5.0+
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Patch available in stable kernel trees