CVE-2026-80933

The Linux kernel's MediaTek mt7996 Wi-Fi driver (part of the mt76 family) fails to validate the size of the default EEPROM firmware file before parsing and copying it as a full-size EEPROM. A truncated EEPROM file causes the driver to read past the end of the firmware buffer during variant validation or the fallback copy, an out-of-bounds read in kernel space. Exploitation requires local access and the ability to control the EEPROM firmware file the driver loads (e.g., writing a crafted file under /lib/firmware and triggering a reload), so the primary realistic impact is kernel memory disclosure or a driver crash/panic, despite the high CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L). Affected systems are those running kernels containing the mt7996 driver — typically routers, access points, and embedded boards based on MediaTek's MT7996 Wi-Fi 7 chipset, including OpenWrt and vendor SDK builds. The fix rejects any EEPROM firmware file shorter than MT7996_EEPROM_SIZE before parsing; no public proof of concept exists and the flaw is not in the CISA Known Exploited Vulnerabilities catalog.

What to do: Upgrade to a kernel build that includes the mt7996 fix rejecting EEPROM firmware files shorter than MT7996_EEPROM_SIZE, and refresh OpenWrt or vendor SDK builds that carry the mt76 driver. Verify that EEPROM firmware files under /lib/firmware on MT7996-based devices come from trusted sources, since the attack path requires supplying a crafted truncated file. No workaround is needed beyond patching, as no exploitation has been observed and local access is required.