Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996_mcu_beacon_cntdwn() emits two bss_bcn_cntdwn_tlv entries (the CSA countdown and the CCA-abort BCC), but MT7996_BEACON_UPDATE_SIZE only reserved one. With MBSSID enabled and a near-maximum beacon template the extra 8 bytes could push the offload command past MT7996_MAX_BSS_OFFLOAD_SIZE and trigger skb_over_panic(). Reserve room for both countdown TLVs.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
98686cd21624c75a043e96812beadddf4f6f48e5 to < 1d348f96623ec20d700af7d4dfc00a74da6238acaffected98686cd21624c75a043e96812beadddf4f6f48e5 to < bc1d694a1ffe0062c3adf0db1d64ad54454398ecaffected98686cd21624c75a043e96812beadddf4f6f48e5 to < 45d8896e4cffffb2c6554ccbec6efe7a0d53166faffected98686cd21624c75a043e96812beadddf4f6f48e5 to < 1a51aff0e048dc5b8252d65808b79939c942d6ecaffected98686cd21624c75a043e96812beadddf4f6f48e5 to < 50c66bab321140c49aa2ed779a3ec9d2f085b458affected
Linux Linux
Default version status: affected
6.2affected0 to < 6.2unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1d348f96623ec20d700af7d4dfc00a74da6238ac ↗
- https://git.kernel.org/stable/c/bc1d694a1ffe0062c3adf0db1d64ad54454398ec ↗
- https://git.kernel.org/stable/c/45d8896e4cffffb2c6554ccbec6efe7a0d53166f ↗
- https://git.kernel.org/stable/c/1a51aff0e048dc5b8252d65808b79939c942d6ec ↗
- https://git.kernel.org/stable/c/50c66bab321140c49aa2ed779a3ec9d2f085b458 ↗