CVE-2026-80933: Linux Kernel mt76 Buffer Overflow Flaw

CVE-2026-80933 Overview

CVE-2026-80933 is a Linux kernel vulnerability in the mt76 Wi-Fi driver for MediaTek mt7996 chipsets. The driver parses and copies the default EEPROM firmware as a full EEPROM without validating its length. A truncated firmware file causes the driver to read beyond the firmware buffer during variant validation or the fallback copy path. This out-of-bounds read affects driver stability and can expose adjacent kernel memory.

Critical Impact
A local user able to influence the loaded EEPROM firmware file can trigger an out-of-bounds read in kernel space, impacting confidentiality, integrity, and availability of the affected system.

Affected Products

Linux kernel mt76 wireless driver
MediaTek mt7996 Wi-Fi chipset support code
Distributions shipping unpatched stable kernels prior to the fix commits

Discovery Timeline

2026-09-11 - CVE-2026-80933 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80933

Vulnerability Analysis

The flaw resides in the MediaTek mt7996 support code within the Linux kernel mt76 wireless driver. During initialization, the driver loads a default EEPROM firmware blob and treats the contents as a full EEPROM image. The parsing and copy paths assume the file is at least MT7996_EEPROM_SIZE bytes long. When the firmware file is shorter than expected, the driver dereferences memory beyond the allocated firmware buffer during variant validation or the fallback copy routine. This condition is a classic out-of-bounds read [CWE-125] rooted in missing input validation on external file input consumed by kernel code.

Root Cause

The driver omits a size check before parsing or copying the default EEPROM firmware. Both the variant validation logic and the fallback copy path index into the buffer using offsets derived from the expected EEPROM layout, not the actual file length. A truncated firmware file therefore causes reads past the buffer end. The fix rejects any firmware file shorter than MT7996_EEPROM_SIZE before parsing or copying.

Attack Vector

Exploitation requires local access with privileges sufficient to influence which firmware blob the kernel loads for the mt7996 driver. An attacker with control over /lib/firmware contents, or a malicious update to firmware packages, can supply a truncated EEPROM file. Loading the driver then triggers the out-of-bounds read. There is no evidence of public exploit code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available. Technical details are documented in the upstream kernel patches referenced below, including Kernel Patch 03b81f01 and Kernel Patch b4bf67cc.

Detection Methods for CVE-2026-80933

Indicators of Compromise

Unexpected kernel log messages from the mt76 or mt7996 driver referencing EEPROM parsing failures or firmware load errors.
Presence of an mt7996 firmware file in /lib/firmware smaller than the documented MT7996_EEPROM_SIZE.
KASAN or similar kernel sanitizer reports flagging out-of-bounds reads in the mt7996 EEPROM code paths.

Detection Strategies

Inventory running kernel versions across Linux endpoints and compare against fixed stable branches referenced in the upstream patches.
Monitor package management events for linux-firmware changes that modify MediaTek mt7996 EEPROM blobs.
Correlate driver load events with subsequent kernel oops or warning messages tied to the mt76 module.

Monitoring Recommendations

Forward dmesg and journald kernel logs to a central analytics platform for anomaly detection on wireless driver events.
Track file integrity on /lib/firmware/mediatek/ to detect unauthorized firmware modifications.
Alert on kernel module load events for mt76 and mt7996 on systems that do not use MediaTek Wi-Fi hardware.

How to Mitigate CVE-2026-80933

Immediate Actions Required

Apply the upstream kernel patches from your distribution as soon as fixed packages are available.
Restrict write access to /lib/firmware to root and audit for unauthorized changes.
On systems without MediaTek mt7996 hardware, blacklist the mt7996e and related mt76 modules to reduce attack surface.

Patch Information

The fix rejects EEPROM firmware files shorter than MT7996_EEPROM_SIZE before parsing or copying. Backports are available in multiple stable branches. Reference commits: Kernel Patch 03b81f01, Kernel Patch 127a291f, Kernel Patch 653c6e28, Kernel Patch 7074ec37, and Kernel Patch b4bf67cc.

Workarounds

Blacklist the mt7996e kernel module on systems that do not require MediaTek Wi-Fi.
Enforce strict file permissions and integrity monitoring on /lib/firmware directories.
Restrict local privileged access to reduce the population of users capable of staging a malicious firmware file.

bash

# Blacklist the vulnerable driver on systems that do not need it
echo "blacklist mt7996e" | sudo tee /etc/modprobe.d/blacklist-mt7996.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep mt7996