GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80935 (GCVE-0-2026-80935)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:59
VLAI
Title
wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr, a device-controlled __le32) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past eeprom.data. Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < 9e5abb5e2ade0b6fd0e47209711115d47a255176 (git)
Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < 6be59da2063d5b3522bfde8aae0487ec095eb384 (git)
Affected: 98686cd21624c75a043e96812beadddf4f6f48e5 , < 13b3c29a782033ce4a230be9e5618032813dbcd4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9e5abb5e2ade0b6fd0e47209711115d47a255176",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            },
            {
              "lessThan": "6be59da2063d5b3522bfde8aae0487ec095eb384",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            },
            {
              "lessThan": "13b3c29a782033ce4a230be9e5618032813dbcd4",
              "status": "affected",
              "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy\n\nmt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block\ncopy from the address reported by the MCU response (event-\u003eaddr, a\ndevice-controlled __le32) and clamps only the copy length, never the\ndestination offset into dev-\u003emt76.eeprom.data. A malicious or\nmalfunctioning device can report an arbitrary address and drive an\nout-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past\neeprom.data.\n\nReject a response whose address would place the copy outside eeprom.data\nbefore deriving the destination pointer. Devices that echo the requested\nin-bounds offset are unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The OOB copy is driven by a MediaTek Wi-Fi 7 MCU EEPROM query response (mt7996/mt7992/mt7990), not a routed IP service; the highest reasonable exposure is an adjacent attacker who can drive malicious firmware or device behavior on the local radio.\nAC:L - A malicious MCU response can set event-\u003evalid and an arbitrary event-\u003eaddr; the host then memcpy\u0027s up to MT7996_EXT_EEPROM_BLOCK_SIZE (1024) device-controlled bytes to eeprom.data+addr with no race or other condition beyond attacker control.\nPR:N - MCU EEPROM responses are consumed in mt7996_eeprom_load() during driver bring-up with no OS credential, capability, or Wi-Fi authentication check; an adjacent attacker needs no local account.\nUI:N - The copy runs automatically in mt7996_eeprom_load() during pci_probe/register after firmware load; no victim action such as mounting a filesystem or opening a file is required.\nS:U - The write corrupts host kernel heap around the mt76 EEPROM buffer and is standard kernel memory corruption, not a VM escape, IOMMU bypass, or other crossed security authority.\nC:H - Attacker-controlled destination offset and payload are kernel memory corruption that can overwrite adjacent objects and pointers and be leveraged for information disclosure, so confidentiality impact is high.\nI:H - Up to 1024 bytes of device-controlled data are written at a device-chosen offset past the 7680-byte eeprom.data allocation, an out-of-bounds write primitive that can yield arbitrary kernel writes or control-flow hijacking.\nA:H - An unbounded kernel heap write during EEPROM init can oops, panic, or hang the host, a high availability impact on Wi-Fi 7 APs, routers, and workstations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:59:01.143Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9e5abb5e2ade0b6fd0e47209711115d47a255176"
        },
        {
          "url": "https://git.kernel.org/stable/c/6be59da2063d5b3522bfde8aae0487ec095eb384"
        },
        {
          "url": "https://git.kernel.org/stable/c/13b3c29a782033ce4a230be9e5618032813dbcd4"
        }
      ],
      "title": "wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80935",
    "datePublished": "2026-09-11T19:42:09.286Z",
    "dateReserved": "2026-08-26T14:34:25.802Z",
    "dateUpdated": "2026-09-14T11:59:01.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80935",
      "date": "2026-09-17",
      "epss": "0.00242",
      "percentile": "0.1557"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9e5abb5e2ade0b6fd0e47209711115d47a255176",
                    "status": "affected",
                    "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6be59da2063d5b3522bfde8aae0487ec095eb384",
                    "status": "affected",
                    "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "13b3c29a782033ce4a230be9e5618032813dbcd4",
                    "status": "affected",
                    "version": "98686cd21624c75a043e96812beadddf4f6f48e5",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.2"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy\n\nmt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block\ncopy from the address reported by the MCU response (event-\u003eaddr, a\ndevice-controlled __le32) and clamps only the copy length, never the\ndestination offset into dev-\u003emt76.eeprom.data. A malicious or\nmalfunctioning device can report an arbitrary address and drive an\nout-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past\neeprom.data.\n\nReject a response whose address would place the copy outside eeprom.data\nbefore deriving the destination pointer. Devices that echo the requested\nin-bounds offset are unaffected."
          }
        ],
        "id": "CVE-2026-80935",
        "lastModified": "2026-09-14T13:18:49.783",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:18:57.403",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/13b3c29a782033ce4a230be9e5618032813dbcd4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6be59da2063d5b3522bfde8aae0487ec095eb384"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9e5abb5e2ade0b6fd0e47209711115d47a255176"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T18:25:12+00:00",
      "cve": "CVE-2026-80935",
      "id": "CVE-2026-80935",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80935.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:06:07Z",
      "cve": "CVE-2026-80935",
      "id": "CVE-2026-80935",
      "initial_release_date": "2026-09-15T01:06:07Z",
      "product_status:known_affected": "114",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80935",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80935.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.