CVE-2026-80933: wifi: mt76: mt7996: validate default EEPROM firmware size
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: validate default EEPROM firmware size
The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during variant validation or the fallback copy.
Reject files shorter than MT7996EEPROMSIZE before parsing or copying the firmware.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure the driver rejects (does not parse) firmware files shorter than MT7996_EEPROM_SIZE before parsing, to prevent read beyond the firmware buffer during variant validation.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel mt76 mt7996 Wi-Fi driver may be exposed when they load a default EEPROM firmware file that is shorter than MT7996_EEPROM_SIZE.
What does an attacker need to exploit this vulnerability?
An attacker would need to cause the driver to use a truncated default EEPROM firmware file. The provided information does not specify how such a file could be supplied or modified.
How can administrators tell whether they are affected?
Check whether affected systems use the mt76 mt7996 driver and whether the default EEPROM firmware file it loads is smaller than MT7996_EEPROM_SIZE. A truncated file can trigger reads beyond the firmware buffer during variant validation or fallback copying.
What mitigation is available if the update cannot be applied immediately?
Ensure that any default EEPROM firmware supplied to the mt7996 driver is not truncated and is at least MT7996_EEPROM_SIZE before it is loaded.