Executive brief
The Linux kernel's mt76 WiFi driver contains a flaw in how it parses firmware responses during device initialization. A malformed firmware response with zero-length data fields could cause the driver to enter an infinite loop, freezing the system during WiFi adapter startup. Additionally, the driver could read memory beyond the intended boundaries without proper validation.
Technical details
The vulnerability is an unbounded loop and buffer read in the mt7996_mcu_get_chip_config function (drivers/net/wireless/mediatek/mt76/mt7996/mcu.c). The TLV (Tag-Length-Value) parsing loop advances by the TLV length field without enforcing a minimum value; a zero-length TLV would cause an infinite loop hanging the CPU during device probe. Additionally, a u32 payload was read without bounds checking. The fix adds bounds validation: rejecting responses shorter than the fixed header, ensuring TLV length is at least the header size, preventing TLV length from exceeding the remaining buffer, and validating the payload exists before accessing it. The vulnerability requires a malicious or corrupted firmware response to trigger; it is not directly network-reachable without local access to the device or its firmware.
Affected products
- Linux Linux kernel All versions with mt7996 support (from commit 5d33053be609 onwards)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched