CVE-2026-74324

A flaw was found in the mt7925 Wi-Fi driver of the Linux kernel. An attacker could exploit this vulnerability by providing a specially crafted firmware response during a test mode query. This improper validation of the response length can lead to a buffer over-read, potentially disclosing sensiti...

The vulnerability of the mt7925_mac_write_txwi_80211() function in the drivers/net/wireless/mediatek/mt76/mt7925/mac.c file of the wireless adapter driver module from mediatek’s Linux kernel, which allows a hacker to compromise the confidentiality and accessibility of protected information.

The vulnerability of the mt7925macwritetxwi80211 function in the drivers/net/wireless/mediatek/mt76/mt7925/mac.c file of the wireless adapter driver module from mediatek’s Linux kernel is related to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could...

CVE-2026-74324

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925tmquery, the response skb from mt76mcusendandgetmsg is used in a memcpy without validating its length: memcpyevtresp, skb-data + 8, MT7925EVTRSPLEN; where...

CVE-2026-74324

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925tmquery, the response skb from mt76mcusendandgetmsg is used in a memcpy without validating its length: memcpyevtresp, skb-data + 8, MT7925EVTRSPLEN; where...

UBUNTU-CVE-2026-74324

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925tmquery, the response skb from mt76mcusendandgetmsg is used in a memcpy without validating its length: memcpyevtresp, skb-data + 8, MT7925EVTRSPLEN; where...

EUVD-2026-59471

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925tmquery, the response skb from mt76mcusendandgetmsg is used in a memcpy without validating its length: memcpyevtresp, skb-data + 8, MT7925EVTRSPLEN; where...

CVE-2026-74324 wifi: mt76: mt7925: validate skb length in testmode query

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925tmquery, the response skb from mt76mcusendandgetmsg is used in a memcpy without validating its length: memcpyevtresp, skb-data + 8, MT7925EVTRSPLEN; where...

CVE-2026-74324

Summary: CVE-2026-74324 affects Linux kernel wireless stack, specifically mt76/mt7925 testmode query handling. In mt7925_tm_query(), the response skb is copied with memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN) without validating length. MT7925_EVT_RSP_LEN is 512, so a firmware response ...

CVE-2026-74324 wifi: mt76: mt7925: validate skb length in testmode query

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925tmquery, the response skb from mt76mcusendandgetmsg is used in a memcpy without validating its length: memcpyevtresp, skb-data + 8, MT7925EVTRSPLEN; where...

Linux Distros Unpatched Vulnerability : CVE-2026-74324

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7925: validate skb length in testmode query In mt7925tmquery, the response skb from mt76mcusendandgetmsg is used in a memcpy without validating i...

PT-2026-72760

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925 tm query, the response skb from mt76 mcu send and get msg is used in a memcpy without validating its length: memcpyevt resp, skb-data + 8, MT7925 EVT RSP LEN;...

CVE-2026-68439

A flaw was found in the Linux kernel's Wi-Fi driver for the mt7925 component. This vulnerability arises from a potential NULL-pointer dereference within the mt7925mcubsshetlv function. If the mt76connacgethephycap routine returns a null value, it is not properly checked before being used, which...

DEBIAN-CVE-2026-68439

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925mcubsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68439

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925mcubsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68439

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925mcubsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68439

The CVE affects the Linux kernel wifi stack, specifically the mt76/mt7925 components. A NULL-pointer dereference could occur in mt7925_mcu_bss_he_tlv() when mt76_connac_get_he_phy_cap may return NULL, and code dereferences the cap pointer without null-checking. The description notes that a fix ha...

CVE-2026-68439 wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925mcubsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68439

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925mcubsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

EUVD-2026-57047

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925mcubsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68439 wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925mcubsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...