CVE-2026-23363

Root

Cause

The vulnerability exists in the function mt7925_mac_write_txwi_80211() within the mt76 WiFi driver for MediaTek MT7925 chipsets. The function fails to validate the frame length before accessing management frame fields, potentially leading to an out-of-bounds memory access [1].

Exploitation

An attacker within radio range of a device using an affected kernel could send a specially crafted 802.11 management frame. When the driver processes this frame during TX descriptor writing, the missing length check allows reading or writing beyond the allocated buffer [2]. No authentication is required; proximity to the target is sufficient.

Impact

Successful exploitation could cause memory corruption, leading to a system crash (denial of service) or potentially arbitrary code execution in kernel context. The out-of-bounds access may corrupt adjacent memory structures, compromising system integrity [3].

Mitigation

The fix, which adds a frame length check before accessing management fields, has been backported to stable kernel branches. Users should update to kernels containing the commits referenced in [1], [2], [3], and [4] (e.g., Linux kernel 6.1.133+ or 6.13.7+). No workarounds are available; applying the patch is necessary to eliminate the vulnerability.