Linux Kernel mt7996 Driver Out-of-Bounds Read Vulnerability and Patch

Vulnerability Summary Vulnerability Overview Vulnerability Type: Out-of-bounds Read Location: function in Root Cause: originates from a 2-bit descriptor field (0-3) and is directly used as an index into the array without bounds checking. When , a value of 3 causes an out-of-bounds access. Trigger Conditions: Corrupted or malicious descriptor values may cause the index to exceed the valid range for , or a combination of a pointer with a carrying . Remediation: Reject invalid values, mirroring the fix in within . Impact Scope Affected Driver: MediaTek Wi-Fi 7 (802.11ac) devices Affected File: Related Commit: Upstream commit Fix Details Fix Commit: ("wifi: mt7996: add driver for MediaTek Wi-Fi 7 (802.11ac) devices") Fix Content: Added a bounds check for in the function to reject invalid values. POC / Exploit Code ```c diff --git a/drivers/net/wireless/mediatek/mt76/mt7996.c b/drivers/net/wireless/mediatek/mt76/mt7996.c index 113b3e808881...448c27c10fe6f7 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996.c @@ -480,7 +481,10 @@ int mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_id, mt7996_get_survey(struct ieee80211_hw dev, enum mt76_rx_q_

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel mt7996 Driver Out-of-Bounds Read Vulnerability and Patch