CVE-2026-80937: Linux Kernel mt76 Buffer Overflow Vulnerability

CVE-2026-80937 Overview

CVE-2026-80937 is an out-of-bounds write vulnerability in the Linux kernel's mt76 wireless driver, specifically affecting the mt7915 chipset support. The flaw resides in mt7915_mcu_get_eeprom(), which copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data buffer using an offset supplied by the device's MCU response. Because the driver trusts the device-controlled res->addr field without bounds checking, a malicious or malfunctioning wireless device can trigger a 16-byte write past the end of the EEPROM buffer.

Critical Impact
An adjacent-network attacker controlling a rogue MediaTek MT7915 device or firmware can corrupt kernel memory, potentially leading to code execution, privilege escalation, or system compromise.

Affected Products

Linux kernel versions containing the vulnerable mt76 driver prior to the fix
Systems using MediaTek MT7915 Wi-Fi chipsets with the in-tree mt76 driver
Stable kernel branches receiving backports referenced by commits 44b5adfe, 5f48b0d7, and 5fdaf701

Discovery Timeline

2026-09-11 - CVE-2026-80937 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80937

Vulnerability Analysis

The mt7915_mcu_get_eeprom() function in the mt76 driver retrieves EEPROM contents from the wireless device via a Microcontroller Unit (MCU) command response. The response structure contains an address field (res->addr, a __le32 value) that indicates where in the driver's EEPROM buffer the incoming 16-byte EFUSE block should be written.

The driver dereferences this address to compute the destination pointer without first validating that the offset plus the copy length remains within the allocated dev->mt76.eeprom.data buffer. When the device returns an arbitrary or attacker-controlled address, the subsequent memcpy writes 16 bytes to an out-of-bounds location in kernel memory adjacent to the EEPROM buffer.

The upstream fix rejects any MCU response whose reported address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected by the check.

Root Cause

The root cause is missing input validation on device-supplied data. The driver treated the res->addr field from the MCU response as trusted, violating the principle that hardware-supplied values crossing a trust boundary must be validated before use as buffer indices.

Attack Vector

Exploitation requires an adjacent network position, typically through a rogue or compromised MT7915-compatible wireless device that responds to EEPROM MCU queries with a malicious addr value. No authentication or user interaction is required at the kernel driver level. Because the write is 16 bytes at an attacker-influenced offset, an adversary can overwrite adjacent kernel structures, function pointers, or allocator metadata to achieve privilege escalation or arbitrary code execution in kernel context.

// No verified proof-of-concept code is available. See the upstream fix commits
// for the exact validation logic added to mt7915_mcu_get_eeprom():
// https://git.kernel.org/stable/c/5fdaf7016d7684ef756a229fd5d96b4a140eeb40

Detection Methods for CVE-2026-80937

Indicators of Compromise

Unexpected kernel oops, KASAN reports, or slab-out-of-bounds warnings referencing mt7915_mcu_get_eeprom or mt76 symbols in dmesg or journalctl -k output
Kernel panics correlated with wireless device enumeration or firmware initialization on hosts using MT7915 chipsets
Anomalous or replaced MT7915-compatible hardware appearing in lspci or USB device inventories

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test systems to surface out-of-bounds writes originating from the mt76 driver
Audit installed kernel versions against the fixed commits 44b5adfe49499f53002737f5fe81d608c08122fc, 5f48b0d752a76590e2c613aae5345c2474627d1b, and 5fdaf7016d7684ef756a229fd5d96b4a140eeb40
Monitor kernel logs for mt76-related warnings and correlate with wireless interface bring-up events

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on driver-level crashes or memory-corruption signatures
Track wireless driver module load events and firmware version changes across the Linux fleet
Establish inventory baselines for wireless chipsets and flag unexpected changes to attached radio hardware

How to Mitigate CVE-2026-80937

Immediate Actions Required

Apply the upstream Linux kernel patch or update to a distribution kernel that incorporates commits 44b5adfe, 5f48b0d7, or 5fdaf701
Inventory all Linux systems with MediaTek MT7915 wireless hardware and prioritize patching for laptops, access points, and embedded devices
Restrict physical and adjacent-network access to systems that cannot be patched immediately

Patch Information

The vulnerability is resolved in the mainline Linux kernel through the fix applied in Kernel Git Commit 5fdaf701, with stable backports available in Kernel Git Commit 44b5adfe and Kernel Git Commit 5f48b0d7. The fix adds a bounds check that rejects MCU responses whose reported address would place the 16-byte EFUSE copy outside the eeprom.data buffer.

Workarounds

Unload the mt7915e or related mt76 kernel modules on systems where wireless functionality is not required, using modprobe -r mt7915e
Blacklist the affected driver modules in /etc/modprobe.d/ on systems that will not be patched promptly
Physically disable or remove MT7915 wireless adapters where practical until the kernel is updated

bash

# Example: blacklist the mt7915e driver until patching is complete
echo "blacklist mt7915e" | sudo tee /etc/modprobe.d/blacklist-mt7915.conf
sudo modprobe -r mt7915e
sudo update-initramfs -u