CVE-2026-80935

The Linux kernel's MediaTek mt7996 Wi-Fi driver (mt76) fails to validate the address field in the Wi-Fi chipset MCU's EEPROM response before copying EFUSE/EXT blocks, so the destination offset into the kernel's dev->mt76.eeprom.data buffer is unbounded even though the copy length is clamped. A malicious or malfunctioning Wi-Fi device can report an arbitrary 32-bit address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past the buffer, causing kernel memory corruption that can crash the system or lead to kernel-level privilege escalation. Affected systems are those running kernels with the mt7996 driver for MediaTek Wi-Fi 7 chipsets, typically routers, access points, and embedded Linux boards, with CVSS 3.1 scored 8.8 (high, adjacent-network vector, no privileges or user interaction required per the scoring). Well-behaved firmware that echoes a requested in-bounds offset is not affected, so exploitation hinges on a compromised, malicious, or buggy device/MCU response. No public proof of concept exists and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Apply kernel updates from your distribution or OpenWrt/embedded vendor once the upstream mt76 mt7996 fix is included, and verify that systems with MT7996-based Wi-Fi are running patched builds. Because the write is driven by device-reported data, only use Wi-Fi firmware from trusted sources and treat unexpected crashes in the mt76 driver on unpatched hosts as a possible indicator. No configuration workaround fully mitigates the flaw, so patching is the primary remediation.