Executive brief
The Linux kernel's mt76 wireless driver contains a boundary validation flaw in receive (RX) packet processing for MediaTek Wi-Fi 7 devices. A corrupt or malformed wireless descriptor with an invalid band index could cause the driver to access memory out of bounds when indexing the internal PHY array, potentially leading to system instability or crash.
Technical details
The vulnerability is a missing input validation flaw in the mt7996_mac_fill_rx() function within drivers/net/wireless/mediatek/mt76/mt7996/mac.c. The band_idx field is extracted from a 2-bit descriptor field (valid range 0–3) and used directly to index dev->mt76.phys[] without bounds checking, but the array size is only __MT_MAX_BAND (3 elements). A corrupt descriptor value or reserved value (3) could index out of bounds or dereference a NULL pointer on devices with fewer bands. The fix adds explicit validation via mt7996_band_valid() and a NULL pointer check before dereferencing the array. Network-reachable attackers can send specially crafted wireless frames to trigger the issue; no authentication is required.
Affected products
- Linux Linux kernel all versions with mt76 mt7996 driver (introduced in kernel with commit 98686cd21624)
Timeline
- 2026-09-17: disclosed