CVE-2026-23315

Vulnerability

Description

In the Linux kernel, an out-of-bounds (oob) access vulnerability exists in the MediaTek Wi-Fi driver component mt76_connac2_mac_write_txwi_80211(). The function fails to properly validate the length of incoming frame data before accessing management frame fields. This missing check could allow an attacker to cause a read or write beyond the allocated buffer boundary, leading to memory corruption or information disclosure [1][4].

Exploitation

Conditions

An attacker would need to craft a special Wi-Fi management frame (e.g., containing an Add Block Acknowledgment (ADDBA) request) that is undersized or malformed. The vulnerable function processes such frames without verifying that the frame is long enough to contain the expected fields, such as mgmt->u.action.u.addba_req.capab. Exploitation requires the ability to inject arbitrary Wi-Fi frames that reach the driver, which typically necessitates proximity to the target device and the ability to send wireless frames to the vulnerable system [1].

Impact

A successful oob access could result in the kernel reading or writing memory outside the intended buffer. This may lead to system instability, denial of service, or potentially an elevation of privilege if the attacker can control the out-of-bounds data. The bug is classified as High severity with a CVSS v3 score of 7.1, reflecting the potential for significant impact [1].

Mitigation

The fix adds a length check to ensure the frame is sufficiently large before accessing management-specific fields. The patch has been applied to the Linux kernel stable branches, and users are advised to update to the corrected kernel versions containing the relevant commit [1][2][3][4].