CVE-2026-23325: Linux Kernel mt76 OOB Access Vulnerability

CVE-2026-23325 Overview

A potential out-of-bounds (OOB) access vulnerability has been identified in the Linux kernel's Wi-Fi subsystem, specifically within the MediaTek mt7996 wireless driver. The vulnerability exists in the mt7996_mac_write_txwi_80211() function, where insufficient frame length validation before accessing management frame fields could allow an attacker to trigger an out-of-bounds memory read.

Critical Impact

This out-of-bounds access vulnerability in the Linux kernel's mt7996 Wi-Fi driver could potentially be exploited to cause system instability, information disclosure, or denial of service on systems using affected MediaTek wireless hardware.

Affected Products

• Linux kernel with mt76/mt7996 Wi-Fi driver enabled
• Systems using MediaTek MT7996 wireless chipsets
• Various Linux kernel versions prior to the security patch

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-23325 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23325

Vulnerability Analysis

The vulnerability resides in the mt7996_mac_write_txwi_80211() function within the MediaTek mt76/mt7996 wireless driver. This function is responsible for writing TX descriptor information for 802.11 management frames. The core issue is a missing bounds check on the frame length before the code attempts to access management frame header fields.

When processing incoming frames, the function accesses management frame structure fields without first verifying that the received frame data is sufficiently long to contain those fields. This can result in the kernel reading memory beyond the allocated buffer boundaries, potentially exposing sensitive kernel memory contents or causing system instability.

The vulnerability is particularly concerning because it occurs in a kernel driver that handles external, potentially attacker-controlled wireless frame data. An attacker with wireless proximity to a vulnerable system could craft malformed 802.11 management frames designed to trigger this out-of-bounds read condition.

Root Cause

The root cause is improper input validation in the mt7996_mac_write_txwi_80211() function. Specifically, the function fails to validate the frame length before accessing management frame header fields (mgmt fields). This is a classic case of missing boundary condition checks, where the code assumes the input data structure is complete without verification.

The fix involves adding proper frame length validation to ensure the buffer contains sufficient data before attempting to access management frame fields, thereby preventing the out-of-bounds memory access.

Attack Vector

An attacker with wireless proximity to a vulnerable system could potentially exploit this vulnerability by:

1. Crafting specially malformed 802.11 management frames with truncated or invalid length fields
2. Transmitting these frames to a system running the vulnerable mt7996 driver
3. When the driver processes these malformed frames, it may read beyond allocated buffer boundaries

The attack is local in nature, requiring the attacker to be within wireless range of the target system. Successful exploitation could lead to information disclosure from kernel memory or denial of service through system instability.

Detection Methods for CVE-2026-23325

Indicators of Compromise

• Unexpected kernel panics or system crashes related to the mt76/mt7996 driver
• KASAN (Kernel Address Sanitizer) reports indicating out-of-bounds reads in mt7996_mac_write_txwi_80211
• Abnormal wireless driver behavior or logging errors related to management frame processing
• Memory corruption indicators in kernel logs referencing the mt76 subsystem

Detection Strategies

• Enable KASAN (Kernel Address Sanitizer) to detect out-of-bounds memory access attempts in kernel drivers
• Monitor kernel logs (dmesg) for warnings or errors from the mt76/mt7996 wireless driver subsystem
• Deploy intrusion detection systems capable of identifying malformed 802.11 management frames
• Implement kernel tracing (ftrace) on the mt7996_mac_write_txwi_80211 function to monitor for anomalous behavior

Monitoring Recommendations

• Regularly review kernel logs for mt76 driver-related errors or warnings
• Implement runtime memory safety checks where feasible in production environments
• Monitor for unusual wireless interface behavior, including unexpected resets or errors
• Configure alerting for any KASAN or memory safety violation reports

How to Mitigate CVE-2026-23325

Immediate Actions Required

• Apply the latest kernel security patches that include the frame length validation fix
• If immediate patching is not possible, consider temporarily disabling the affected wireless interface on critical systems
• Review and update kernel versions on all systems utilizing MediaTek MT7996 wireless hardware
• Monitor vendor security advisories for updated guidance

Patch Information

The Linux kernel maintainers have released patches addressing this vulnerability by adding proper frame length validation before accessing management frame fields. Multiple stable kernel branches have received fixes:

• Kernel Commit 45661d22639c
• Kernel Commit 60862846308627
• Kernel Commit a6605f61913155
• Kernel Commit ca1adc04fc2cb
• Kernel Commit f4cdf6b43689e

Organizations should update to kernel versions containing these patches through their standard system update procedures.

Workarounds

• Disable the mt7996 wireless interface if the device is not required for operations
• Use alternative wireless hardware not affected by this vulnerability until patches can be applied
• Implement network segmentation to limit wireless attack surface
• Consider using a wired network connection on critical systems while awaiting patching

# Temporarily disable the affected wireless interface
sudo ip link set wlan0 down

# Unload the mt7996 driver module if not required
sudo modprobe -r mt7996

# Blacklist the driver to prevent automatic loading (temporary measure)
echo "blacklist mt7996" | sudo tee /etc/modprobe.d/blacklist-mt7996.conf