The vulnerability affects the embedded energy-independent single-write eFUSE memory module in Realtek RTL8762C, a highly integrated wireless system on chip (SoC). This module allows a hacker to circumvent existing security restrictions and expose sensitive information.

The vulnerability of the embedded energy-independent single-write eFUSE memory in the highly integrated wireless system on chip SoC Realtek RTL8762C is related to the fact that power is turned on before the access control mechanism is activated. Exploiting this vulnerability can allow a hacker to...

sonos

sonos/amlogic haxx here you will find some exploit & tool code that was part of my presentation about the Sonos One @ Hack in the Box amsterdam 2023. the EL3 exploit can be used to dump your OTP/eFUSE data. sonostool can be used to get decryption keys for Sonos LUKS volumes as well as fetch and...

AZL-100416 CVE-2026-80937 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

CVE-2026-80937

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

CVE-2026-80937 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

CVE-2026-80937 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

CVE-2026-80937

CVE-2026-80937 is an out-of-bounds write in the Linux kernel's mt76 Wi-Fi driver for mt7915 chipsets. The function mt7915_mcu_get_eeprom() copies a 16-byte EFUSE block into the driver's eeprom.data buffer at an offset supplied by the device MCU (res->addr), a device-controlled __le32, without ...

CVE-2026-80937

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

CVE-2026-80935 wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-80935 wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-80935

CVE-2026-80935 affects the Linux kernel mt76 Wi-Fi driver for MediaTek MT7996 devices. The function mt7996_mcu_get_eeprom() uses a device-controlled 32-bit address (event->addr) as a destination offset into dev->mt76.eeprom.data without bounds-checking it, only clamping the copy length. A m...

PT-2026-90067

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915 mcu get eeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: rtlwifi – significantly reduced the attempts to read efuse in case of failures. Syzkaller reported a hung task with ueventshow on the stack trace. That specific issue was addressed by another commit 0. However, even with th...

The vulnerability of the zynqmp_efuse_access() function in the drivers/nvmem/zynqmp_nvmem.c file of the NVMEM device driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the zynqmpefuseaccess function in the drivers/nvmem/zynqmpnvmem.c file of the NVMEM device driver in the Linux operating system is related to incorrect calculation of the buffer size. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/mediatek/lvtsthermal: Fixed a memory leak in the error handling path. If devmkrealloc fails, then ‘efuse’ is leaking memory. Therefore, it should be freed to avoid the memory leak...

EUVD-2022-48071

Malicious code in bioql PyPI...

EUVD-2024-51862

Malicious code in bioql PyPI...

wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures

...

CVE-2022-45163

An information-disclosure vulnerability exists on select NXP devices when configured in Serial Download Protocol SDP mode: i.MX RT 1010, i.MX RT 1015, i.MX RT 1020, i.MX RT 1050, i.MX RT 1060, i.MX 6 Family, i.MX 7Dual/Solo, i.MX 7ULP, i.MX 8M Quad, i.MX 8M Mini, and Vybrid. In a device...

CVE-2019-17391

An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32 chip allows an attacker with physical access to the device to read the contents of read-protected eFuses, such as flash encryption and...