CVE-2026-90369: wifi: mt76: fix out-of-bounds access in mmio copy helpers
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: fix out-of-bounds access in mmio copy helpers
mt76mmiowritecopy() and mt76mmioreadcopy() iterate up to ALIGN(len, 4), so a length that is not a multiple of four reads past the source buffer (writecopy) or writes past the destination (readcopy). Copy the aligned body in the loop and handle the remaining tail through a 4-byte bounce buffer, keeping the register access width unchanged.
Affected Software
Event History
Frequently Asked Questions
What input condition causes the invalid memory access?
The issue occurs when either MMIO copy helper is called with a length that is not a multiple of four bytes. The helpers iterate through ALIGN(len, 4), causing the final iteration to exceed the requested buffer length.
Which buffer is accessed out of bounds?
mt76_mmio_write_copy() can read beyond its source buffer, while mt76_mmio_read_copy() can write beyond its destination buffer. The resolved implementation handles the unaligned trailing bytes with a 4-byte bounce buffer while preserving 4-byte register accesses.