Listen to this Post
The vulnerability exists in the `mt76` WiFi driver for MediaTek MT7996 chipsets within the Linux kernel. It stems from a missing validation check in the receive (RX) data path. The driver uses WCID (Wireless Client IDentifier) entries to manage station data. Certain non-station WCID entries, like the global management entry, should not be processed by standard RX functions.
The flaw allows an improper WCID entry to be passed to `mt7996_sta_link` handling routines. Internally, the code uses the `container_of` macro to cast the WCID pointer back to a struct mt7996_sta_link. When a global WCID is incorrectly passed, this cast results in an invalid pointer calculation. This corrupts the driver’s internal WCID array data structure in memory. The corruption leads to a kernel panic or system crash, causing a denial of service. Exploitation requires local access to the system with privileges to configure or manipulate the WiFi interface. The issue is fixed by adding a check to filter out non-station WCID entries before the RX processing and pointer cast.
DailyCVE Form:
Platform: Linux Kernel
Version: mt76 mt7996 driver
Vulnerability: Missing Entry Check
Severity: Medium
Date: 2025-10-01
Prediction: 2025-10-15 Patched
What Undercode Say:
Check current kernel version uname -r Verify the loaded mt76 module version modinfo mt76 | grep version List loaded kernel modules, filter for mt76 lsmod | grep mt76 Search system log for mt76 or mt7996 related errors dmesg | grep -E "mt76|mt7996"
How Exploit:
Local privilege escalation. Attacker with user access and capability to interact with the WiFi interface (e.g., via nl80211) triggers the invalid pointer cast. This corrupts kernel memory, leading to a crash (DoS) or potentially allowing for arbitrary code execution in kernel context.
Protection from this CVE:
Update Linux kernel. Apply patch wifi: mt76: mt7996: add missing check for rx wcid entries. Disable affected MT7996 WiFi if unpatched. Use kernel lockdown where supported.
Impact:
System crash, denial-of-service, potential kernel memory corruption leading to instability or further compromise on vulnerable systems with the affected MediaTek WiFi hardware.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
