CVE-2026-23325

Vulnerability

Analysis

CVE-2026-23325 is an out-of-bounds (oob) access vulnerability in the Linux kernel's MediaTek MT7996 Wi-Fi driver (mt76). The flaw resides in the mt7996_mac_write_txwi_80211() function, which writes transmit descriptor information for 802.11 frames. The root cause is an insufficient frame length check before accessing management frame fields, potentially leading to an oob read or write when processing unusually short or malformed frames [1].

Exploitation

Details

To trigger the vulnerability, an attacker would need the ability to transmit specially crafted 802.11 management frames to a device using the MT7996 chipset. This could be achieved by being within radio range of the target and sending a malformed frame that bypasses normal length validation. No authentication is required, as the vulnerability lies in the frame processing path before any security checks are applied.

Impact

A successful exploit could allow the attacker to read out-of-bounds memory, potentially leaking sensitive data, or cause a system crash (denial of service). In worst-case scenarios, oob write primitives might be leveraged for code execution, though the CVE description only explicitly mentions oob access.

Mitigation

The fix involves adding a frame length check before mt7996_mac_write_txwi_80211() accesses mgmt fields. The patch has been applied to the stable kernel tree [1]. Users should update to a kernel version containing this patch or apply the specific commit to their kernel build.