Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-74324

wifi: mt76: mt7925: validate skb length in testmode query

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925_tm_query(), the response skb from mt76_mcu_send_and_get_msg() is used in a memcpy without validating its length: memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN); where MT7925_EVT_RSP_LEN is 512. If the firmware returns a response shorter than 520 bytes (8 + 512), this reads beyond the skb data buffer. The over-read data is then returned to userspace via nla_put() in mt7925_testmode_dump(). Add a length check before the memcpy to ensure the skb contains sufficient data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • c948b5da6bbec742b433138e3e3f9537a85af2e5 to < c386e90a7ce8ddec9f038e9437661a2821b0ce89affected
  • c948b5da6bbec742b433138e3e3f9537a85af2e5 to < e8b214b6d6e1902025452db0a0af73dc9693e4baaffected
  • c948b5da6bbec742b433138e3e3f9537a85af2e5 to < c7369a00860a0704461d440e7c3bf9b49bfdbaeeaffected

Linux Linux

Default version status: affected

  • 6.7affected
  • 0 to < 6.7unaffected
  • 6.18.40 to ≤ 6.18.*unaffected
  • 7.1.5 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References