CVE-2026-74324: wifi: mt76: mt7925: validate skb length in testmode query
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: validate skb length in testmode query
In mt7925tmquery(), the response skb from mt76mcusendandgetmsg() is used in a memcpy without validating its length:
memcpy(evtresp, skb->data + 8, MT7925EVTRSPLEN);
where MT7925EVTRSPLEN is 512. If the firmware returns a response shorter than 520 bytes (8 + 512), this reads beyond the skb data buffer. The over-read data is then returned to userspace via nlaput() in mt7925testmodedump().
Add a length check before the memcpy to ensure the skb contains sufficient data.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In mt7925_testmode_dump(), add a length check on the response skb returned by mt76_mcu_send_and_get_msg() so that the skb contains at least 8 bytes of header data plus MT7925_EVT_RSP_LEN (512) bytes before executing memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN).
Linux kernel (wifi: mt76: mt7925 testmode query) memcpy length validation before copying from response skb = Ensure skb->len is at least 8 + MT7925_EVT_RSP_LEN (520) before calling memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN)