CVE-2026-74324: wifi: mt76: mt7925: validate skb length in testmode query
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: validate skb length in testmode query
In mt7925tmquery(), the response skb from mt76mcusendandgetmsg() is used in a memcpy without validating its length:
memcpy(evtresp, skb->data + 8, MT7925EVTRSPLEN);
where MT7925EVTRSPLEN is 512. If the firmware returns a response shorter than 520 bytes (8 + 512), this reads beyond the skb data buffer. The over-read data is then returned to userspace via nlaput() in mt7925testmodedump().
Add a length check before the memcpy to ensure the skb contains sufficient data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In mt7925_testmode_dump(), add a length check on the response skb returned by mt76_mcu_send_and_get_msg() so that the skb contains at least 8 bytes of header data plus MT7925_EVT_RSP_LEN (512) bytes before executing memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN).
Linux kernel (wifi: mt76: mt7925 testmode query) memcpy length validation before copying from response skb = Ensure skb->len is at least 8 + MT7925_EVT_RSP_LEN (520) before calling memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74324?
CVE-2026-74324 has been assigned a risk level of 37.
What does CVE-2026-74324 affect?
CVE-2026-74324 affects the mt7925 driver in the Linux kernel specifically related to handling skb length in testmode queries.
How do I fix CVE-2026-74324?
To fix CVE-2026-74324, update the Linux kernel to the latest version where this vulnerability has been addressed.
What type of attack does CVE-2026-74324 enable?
CVE-2026-74324 can potentially lead to memory corruption due to improper length validation in packet handling.
When was CVE-2026-74324 published?
CVE-2026-74324 was published on August 15, 2026.