CVE-2026-80935 Overview
CVE-2026-80935 is an out-of-bounds write vulnerability in the Linux kernel's mt76 Wi-Fi driver for MediaTek MT7996 chipsets. The mt7996_mcu_get_eeprom() function derives the destination offset for an EFUSE/EXT block copy from event->addr, a device-controlled __le32 value returned by the microcontroller unit (MCU). The driver clamps only the copy length and never validates the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address, driving an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past the EEPROM buffer.
Critical Impact
An attacker with adjacent network access or control over an MT7996 Wi-Fi device can trigger kernel memory corruption, leading to privilege escalation, denial of service, or arbitrary code execution in kernel context.
Affected Products
- Linux kernel builds shipping the mt76 wireless driver with MT7996 support
- Systems using MediaTek MT7996-family Wi-Fi chipsets
- Distributions tracking upstream stable kernel branches prior to the patch commits
Discovery Timeline
- 2026-09-11 - CVE-2026-80935 published to the National Vulnerability Database
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-80935
Vulnerability Analysis
The flaw resides in mt7996_mcu_get_eeprom() within the MediaTek mt76 wireless driver. The function processes MCU response events that carry an address field (event->addr) indicating where EFUSE or EXT block data should be written inside the kernel-side EEPROM buffer dev->mt76.eeprom.data. The existing code path bounds the length of the copy but trusts the device-supplied destination offset. Because the address is a little-endian 32-bit value directly controlled by the device, an attacker-influenced response can position the write far beyond the allocated buffer.
This is classified as an Out-of-Bounds Write in kernel memory. The corruption occurs during EEPROM retrieval, which typically executes with kernel privileges as part of driver initialization or runtime firmware interaction.
Root Cause
The root cause is missing input validation on a device-controlled field. The driver uses event->addr as an index into dev->mt76.eeprom.data without verifying that addr + copy_length remains within the allocated buffer. The upstream fix rejects any response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected by the change.
Attack Vector
Exploitation requires the ability to influence MCU responses returned by an MT7996 Wi-Fi device. This maps to an adjacent-network attack surface where a rogue or compromised wireless device, or a device tampered with in the supply chain, sends a crafted response containing an arbitrary addr value. The kernel then writes up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past the EEPROM buffer, corrupting adjacent kernel structures. Successful exploitation can yield kernel memory corruption used for privilege escalation or denial of service.
No verified public proof-of-concept code is available. Refer to the upstream patches for technical details: Kernel Git Commit 13b3c29, Kernel Git Commit 6be59da2, and Kernel Git Commit 9e5abb5e.
Detection Methods for CVE-2026-80935
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing mt7996_mcu_get_eeprom, mt76, or slab/page corruption during Wi-Fi initialization
- KASAN reports flagging out-of-bounds writes within the mt76 module on systems using MT7996 hardware
- Wireless interfaces failing to initialize or reporting corrupted EEPROM data after firmware handshake
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) on test kernels to surface out-of-bounds writes originating from the mt76 driver
- Monitor kernel ring buffer (dmesg) for warnings, stack traces, or slab corruption originating from mt7996_* symbols
- Inventory hosts running affected Linux kernel versions with MT7996 hardware and compare against patched stable releases
Monitoring Recommendations
- Collect and centralize kernel logs from Linux endpoints and network appliances that ship MediaTek Wi-Fi chipsets
- Alert on repeated wireless driver crashes or module reloads, which may indicate exploitation attempts
- Track vendor firmware and kernel update advisories for MediaTek MT7996 platforms
How to Mitigate CVE-2026-80935
Immediate Actions Required
- Upgrade to a Linux kernel release containing the upstream mt76 fix commits referenced in the NVD entry
- Prioritize patching mobile devices, laptops, routers, and access points that use MediaTek MT7996 chipsets
- Restrict wireless association to trusted networks and disable Wi-Fi where MT7996 hardware cannot be immediately patched
Patch Information
The vulnerability is resolved in upstream Linux kernel commits 13b3c29a, 6be59da2, and 9e5abb5e. The fix validates that the address returned by the MCU response places the copy fully inside eeprom.data before dereferencing the destination pointer. Apply the corresponding stable kernel update from your distribution vendor.
Workarounds
- Unload the mt7996e and mt76 kernel modules on systems where the Wi-Fi interface is not required
- Blacklist affected modules in /etc/modprobe.d/ until a patched kernel can be deployed
- Physically disable or remove untrusted MT7996 wireless adapters in high-risk environments
# Blacklist the affected driver until a patched kernel is installed
echo "blacklist mt7996e" | sudo tee /etc/modprobe.d/blacklist-mt7996.conf
echo "blacklist mt76" | sudo tee -a /etc/modprobe.d/blacklist-mt7996.conf
sudo update-initramfs -u
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.