201 lines
11 KiB
JSON
201 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-80933",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-08-26T14:34:25.802Z",
|
|
"datePublished": "2026-09-11T19:42:07.754Z",
|
|
"dateUpdated": "2026-10-19T08:45:17.026Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-19T08:45:17.026Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: validate default EEPROM firmware size\n\nThe default EEPROM firmware is parsed and copied as a full EEPROM\nwithout checking its length. A truncated file can make the driver\nread beyond the firmware buffer during variant validation or the\nfallback copy.\n\nReject files shorter than MT7996_EEPROM_SIZE before parsing or\ncopying the firmware."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The truncated default EEPROM image is consumed only via request_firmware() on the local PCI probe path (mt7996_pci_probe → mt7996_register_device → mt7996_init_hardware → mt7996_eeprom_init → mt7996_eeprom_check_or_use_default); WiFi frames, network protocols, and USB traffic never reach this parser.\nAC:L - A non-empty file shorter than MT7996_EEPROM_SIZE (7680 bytes) deterministically over-reads: variant validation indexes fw->data at MT_EE_WIFI_CONF, and a crafted WIFI_CONF that fails the match (or the common use_default fallback) takes memcpy(eeprom, fw->data, 7680) with no race or layout luck.\nPR:L - The parse path has no capability check, and default EEPROM blobs live under /lib/firmware/mediatek/mt7996/ and vendor firmware partitions on OpenWrt/AP/Android Filogic deployments that are often writable by non-root system or OTA accounts, so a low-privileged local user can position the truncated image.\nUI:N - Once the truncated EEPROM firmware file is in place, request_firmware() and the subsequent parse/copy run automatically during driver probe at boot or module bind; no victim action such as opening a device node or mounting a filesystem is required.\nS:U - The out-of-bounds read and the EEPROM/MCU state it poisons remain inside the host kernel and the local MT7996 device; this is not a VM escape, IOMMU bypass, or other cross-authority breakout.\nC:H - memcpy(..., 7680) and mt7996_eeprom_parse_stream() read far past the firmware buffer into eeprom.data, which is then used as the interface MAC, exposed via the 0400 debugfs eeprom blob, and uploaded to the MCU—an unbounded kernel-memory disclosure, not a few-byte leak.\nI:H - The fallback memcpy writes the over-read kernel memory into the live 7680-byte EEPROM object that then drives MAC/capability configuration and mt7996_mcu_set_eeprom() programming of the WiFi 7 MCU, so attacker-influenced data corrupts kernel and device control state; memory-corruption copies are rated High.\nA:H - Firmware buffers are vmalloc/vmap allocations with guard pages, so a 7680-byte over-read from a short file reliably faults into an unmapped page and oopses or panics the kernel during probe of MT7996/MT7992/MT7990 hardware."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
|
|
"lessThan": "b4bf67cc0871b13103c404b38e332b9d4403a0da",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
|
|
"lessThan": "127a291f4c8069a4e71906938402cacfe24ee8cd",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
|
|
"lessThan": "03b81f015dbb29807ce1ec6d45537d658abdac69",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
|
|
"lessThan": "7074ec3769820302f1ccf8794a40a6582153b820",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
|
|
"lessThan": "653c6e289b13cc6942f3e8f8e3c568e70fa42d1f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.2",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.2",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.157",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.110",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.50",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.4",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.6.157"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.12.110"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.18.50"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "7.2.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b4bf67cc0871b13103c404b38e332b9d4403a0da"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/127a291f4c8069a4e71906938402cacfe24ee8cd"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/03b81f015dbb29807ce1ec6d45537d658abdac69"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/7074ec3769820302f1ccf8794a40a6582153b820"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/653c6e289b13cc6942f3e8f8e3c568e70fa42d1f"
|
|
}
|
|
],
|
|
"title": "wifi: mt76: mt7996: validate default EEPROM firmware size",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |