CVE-2026-80937

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

CVE-2026-80937 wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...

CVE-2026-80937

CVE-2026-80937 affects the Linux kernel mt76 WiFi driver, specifically the mt7915 hardware path. The function mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's eeprom.data buffer using an offset (res->addr) supplied by the device as a __le32, without validating it against th...

CVE-2026-80935 wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-80935

CVE-2026-80935 affects the Linux kernel mt76 Wi-Fi driver for mt7996 devices. The vulnerable function, mt7996_mcu_get_eeprom(), derives the EFUSE/EXT block copy destination from an address reported by the MCU response (event->addr, a device-controlled __le32). Only the copy length was clamped;...

PT-2026-90067

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915 mcu get eeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...