CVE-2026-80935 wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-80935

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-80935 wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...

CVE-2026-80935

CVE-2026-80935 affects the Linux kernel mt76 Wi-Fi driver for MediaTek MT7996 devices. The function mt7996_mcu_get_eeprom() uses a device-controlled 32-bit address (event->addr) as a destination offset into dev->mt76.eeprom.data without bounds-checking it, only clamping the copy length. A m...

EUVD-2026-76257

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames MTTXD7MACTXD, set in mt7996macwritetxwi80211, but are otherwise FW-TXP devices. On tx free...

CVE-2026-80934

CVE-2026-80934 affects the Linux kernel WiFi driver mt76 mt7996 (and mt7992). The root cause is a TX DMA mapping leak on AddBA request action frames: these frames use a HW MAC-TXP layout, but the TX-free path incorrectly decodes them as FW-TXP, causing the unmap loop to run zero times and the DMA...

CVE-2026-80934 wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames MTTXD7MACTXD, set in mt7996macwritetxwi80211, but are otherwise FW-TXP devices. On tx free...

CVE-2026-80934 wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames MTTXD7MACTXD, set in mt7996macwritetxwi80211, but are otherwise FW-TXP devices. On tx free...

EUVD-2026-76256

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

CVE-2026-80933 wifi: mt76: mt7996: validate default EEPROM firmware size

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

CVE-2026-80933

This Linux kernel vulnerability affects the mt76: mt7996 Wi-Fi driver . The driver parses and copies the default EEPROM firmware without validating its length, so a truncated firmware file can cause the driver to read beyond the allocated buffer during variant validation or the fallback copy. Red...

CVE-2026-80933 wifi: mt76: mt7996: validate default EEPROM firmware size

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

CVE-2026-80933

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

PT-2026-90064

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames mt7996/mt7992 hand the firmware a HW MAC-TXP for AddBA req action frames MT TXD7 MAC TXD, set in mt7996 mac write txwi 80211, but are otherwise FW-TXP devices. On t...

PT-2026-90063

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...

CVE-2026-80632

A flaw was found in the Linux kernel's Wi-Fi driver, specifically within the mt7996 component. When the MT76NPU and CONFIGNETMEDIATEKSOCWED configurations are enabled and the Airoha NPU System-on-Chip SoC is detected, the mt7996inittxqueues function can attempt to dereference a NULL Wi-Fi/Etherne...

Linux Distros Unpatched Vulnerability : CVE-2026-80632

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and...

CVE-2026-80632

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

CVE-2026-80632

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

UBUNTU-CVE-2026-80632

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...