What happened
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during variant validation or the fallback copy. Reject files shorter than MT7996_EEPROM_SIZE before parsing or copying the firmware.
Affected versions
Linux: 98686cd21624c75a043e96812beadddf4f6f48e5 through before 03b81f015dbb29807ce1ec6d45537d658abdac69 (git); 98686cd21624c75a043e96812beadddf4f6f48e5 through before 7074ec3769820302f1ccf8794a40a6582153b820 (git); 98686cd21624c75a043e96812beadddf4f6f48e5 through before 653c6e289b13cc6942f3e8f8e3c568e70fa42d1f (git); 6.2 Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
No public PoC reference has passed the current publication threshold.