CVE-2026-80937
- Source
- https://cve.org/CVERecord?id=CVE-2026-80937
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-80937.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-80937
- Downstream
- Related
- Published
- 2026-09-11T19:42:10Z
- Modified
- 2026-10-05T02:30:35Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data buffer at the offset reported by the MCU response (res->addr, a device-controlled __le32) without checking it against the buffer size. A malicious or malfunctioning device can report an arbitrary address and drive a 16-byte out-of-bounds write past eeprom.data.
Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80937.json" }- References
-
- https://git.kernel.org/stable/c/394e8cb56fc732d71041599cdb4e01f82cfd11c5
- https://git.kernel.org/stable/c/44b5adfe49499f53002737f5fe81d608c08122fc
- https://git.kernel.org/stable/c/5f48b0d752a76590e2c613aae5345c2474627d1b
- https://git.kernel.org/stable/c/5fdaf7016d7684ef756a229fd5d96b4a140eeb40
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80937.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-80937
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede57b7901469fc0b021930b83a8094baaf3d81b09Fixed394e8cb56fc732d71041599cdb4e01f82cfd11c5Fixed5fdaf7016d7684ef756a229fd5d96b4a140eeb40Fixed5f48b0d752a76590e2c613aae5345c2474627d1bFixed44b5adfe49499f53002737f5fe81d608c08122fc