CVE-2026-80937

The mt7915 Wi-Fi driver in the Linux kernel fails to validate the EFUSE address returned by the device's MCU firmware before copying a 16-byte block into the driver's fixed-size eeprom.data buffer in mt7915_mcu_get_eeprom(). A malicious or malfunctioning MediaTek MT7915 (Filogic Wi-Fi 6) chipset can report an arbitrary __le32 address in its MCU response, driving a 16-byte out-of-bounds write past the buffer and corrupting adjacent kernel memory. Successful exploitation could yield kernel memory corruption with high impact to confidentiality, integrity, and availability (CVSS 8.8, adjacent-network vector, no privileges or user interaction required), though in practice it requires an attacker-controlled or compromised Wi-Fi device on the affected system. Systems using MT7915-based hardware with the in-kernel mt76 driver — common in OpenWrt-style routers, access points, and embedded boards — are affected; devices that simply echo a valid requested offset are unaffected. No public proof-of-concept exists and the flaw is not in the CISA KEV catalog, so exploitation status is none known.

What to do: Apply Linux kernel updates (or OpenWrt/embedded firmware updates) containing the patch that rejects MCU EEPROM responses whose address would place the copy outside eeprom.data. Prioritize systems where the Wi-Fi device or its firmware comes from an untrusted or third-party source, since exploitation requires a malicious or malfunctioning MT7915 device. Check kernel logs for crashes or corruption originating in mt7915_mcu_get_eeprom() on MT7915-based hardware.