CVE-2026-46136: Linux Kernel mt7921 DoS Vulnerability

CVE-2026-46136 Overview

CVE-2026-46136 affects the Linux kernel mt76 wireless driver, specifically the mt7921 MediaTek WiFi chipset support. The vulnerability is an integer underflow in the Country Location Configuration (CLC) handling code. The buf_len variable, used to limit iterations when retrieving country power settings, can underflow due to changes in the CLC power table. This underflow produces an almost infinite loop or yields an invalid power setting, causing driver initialization to fail. The flaw was resolved upstream through multiple stable kernel commits.

Critical Impact
An underflow in buf_len during CLC parsing triggers a near-infinite loop or invalid radio power configuration, preventing the mt7921 WiFi driver from initializing and leaving affected systems without wireless connectivity.

Affected Products

Linux kernel mt76 wireless driver subsystem
MediaTek mt7921 WiFi chipset driver
Linux distributions shipping vulnerable kernel versions prior to the referenced stable patches

Discovery Timeline

2026-05-28 - CVE-2026-46136 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46136

Vulnerability Analysis

The vulnerability resides in the mt7921 driver's handling of the CLC (Country Location Configuration) power table. The driver iterates over CLC entries to retrieve per-country regulatory power settings during initialization. The loop uses buf_len as the remaining-bytes counter and decrements it as entries are consumed.

When the CLC power table layout changes or contains entries that do not match expected size assumptions, the decrement operation reduces buf_len below zero. Because buf_len is treated as an unsigned value, the result wraps to a very large positive integer. The loop continuation check then permits many additional iterations against memory that no longer contains valid CLC data, or returns malformed power configuration bytes.

The outcome is one of two failure modes: the driver enters a near-infinite parsing loop that stalls initialization, or it programs invalid transmit power values into the radio. In both cases the WiFi interface fails to come up, which is a denial-of-service condition affecting wireless functionality on systems using mt7921 chipsets.

Root Cause

The root cause is missing bounds validation on the remaining buffer length before decrementing it during CLC table iteration. The code assumes the CLC entries fit cleanly within the supplied buffer, but firmware changes to the CLC power table format violate that assumption. Without a signed comparison or pre-decrement check, the unsigned buf_len wraps and the loop terminator never triggers.

Attack Vector

This vulnerability is triggered during driver initialization when the mt7921 driver loads CLC data supplied by firmware. There is no indication of remote network exploitation. The practical impact is loss of WiFi availability on affected hardware after a firmware or kernel update introduces an incompatible CLC layout. No verified proof-of-concept code is publicly available for this issue.

The upstream fix adds proper length validation before decrementing buf_len, ensuring the loop exits cleanly when the remaining buffer cannot accommodate another CLC entry. See the referenced kernel commits for the exact patch logic.

Detection Methods for CVE-2026-46136

Indicators of Compromise

Kernel log messages reporting mt7921 driver initialization failures or timeouts during CLC processing.
WiFi interface failing to register on systems equipped with MediaTek mt7921 chipsets after a kernel update.
Soft lockup or RCU stall warnings referencing mt7921 functions in dmesg output.

Detection Strategies

Inventory Linux systems by kernel version and identify hosts running unpatched kernels with the mt76/mt7921 modules loaded.
Compare the running kernel against the fixed commits (0aa63d33, 5373f8b1, 90cc573f, a0111847, e451c325) referenced in the kernel.org stable tree.
Monitor for repeated wireless driver load failures across managed endpoint fleets using existing endpoint telemetry.

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized log platform and alert on mt7921 error patterns.
Track lsmod and modinfo mt7921e output during configuration management runs to detect mismatched module versions.
Add WiFi interface availability checks to host health monitoring for laptops and embedded devices using MediaTek radios.

How to Mitigate CVE-2026-46136

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 0aa63d33, 5373f8b1, 90cc573f, a0111847, and e451c325.
Update to a distribution kernel package that incorporates the mt76: mt7921: fix a potential clc buffer length underflow fix.
Verify that any out-of-tree builds of the mt76 driver are rebased against the patched source.

Patch Information

The fix is available in the Linux stable tree across multiple branches. The relevant commits add bounds checking around buf_len before it is decremented during CLC power table iteration. Refer to the Kernel Commit 0aa63d33, Kernel Commit 5373f8b1, Kernel Commit 90cc573f, Kernel Commit a0111847, and Kernel Commit e451c325 for the patch contents.

Workarounds

Blacklist the mt7921e and mt7921 modules on affected hosts until a patched kernel is deployed, accepting loss of WiFi functionality.
Use a wired network connection or an alternate USB WiFi adapter that does not rely on the mt76 driver stack.
Pin systems to a known-good kernel and firmware combination prior to the CLC table change that introduced the underflow condition.

bash

# Configuration example: blacklist the affected module until patched
echo "blacklist mt7921e" | sudo tee /etc/modprobe.d/mt7921-cve-2026-46136.conf
echo "blacklist mt7921_common" | sudo tee -a /etc/modprobe.d/mt7921-cve-2026-46136.conf
sudo update-initramfs -u
sudo reboot