CVE-2026-23315 - Vulnerability Details

- wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()

Check frame length before accessing the mgmt fields in
mt76_connac2_mac_write_txwi_80211 in order to avoid a possible oob
access.

[fix check to also cover mgmt->u.action.u.addba_req.capab,
correct Fixes tag]

Published: 2026-03-25

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel's mt76 Wi‑Fi driver permits an out‑of‑bounds memory read through the function mt76_connac2_mac_write_txwi_80211() when the frame length is not validated. This can expose kernel memory contents or lead to further corruption, thereby compromising the confidentiality and integrity of the kernel.

Affected Systems

The vulnerability is present in all Linux kernel releases that include the vulnerable mt76 driver code. Vendor information points to the Linux kernel itself, though no specific kernel version is listed in the advisory.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, while an EPSS below 1% signals a low probability of exploitation. The flaw requires kernel execution, implying a local‑privilege or kernel‑level attack; remote exploitation is unlikely. The vulnerability is not in the CISA KEV catalog. The likely attack vector is inferred to be local.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`577dbc6c656da6997dddc6cf842b7954588f2d4e`	affected	< 84419556359bc96d3fe1623d47a64c86542566cc
`577dbc6c656da6997dddc6cf842b7954588f2d4e`	affected	< 7ae7b093b7dba9548a3bc4766b9364b97db4732d
`577dbc6c656da6997dddc6cf842b7954588f2d4e`	affected	< 7b692dff8df0ba5feb8df00f27d906d6eb1fe627
`577dbc6c656da6997dddc6cf842b7954588f2d4e`	affected	< 9612d91f617231e03c49cb9b0c02f975a3b4f51f
`577dbc6c656da6997dddc6cf842b7954588f2d4e`	affected	< 0fb3b94a9431a3800717e5c3b6fa2e1045a15029
`577dbc6c656da6997dddc6cf842b7954588f2d4e`	affected	< 4e10a730d1b511ff49723371ed6d694dd1b2c785

Linux

affected

Version	Status	Constraints
`5.10`	affected	—
`0`	unaffected	< 5.10
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.77`	unaffected	≤ 6.12.*
`6.18.17`	unaffected	≤ 6.18.*
`6.19.7`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:5.10:-::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[577dbc6c656da6997dddc6cf842b7954588f2d4e,84419556359bc96d3fe1623d47a64c86542566cc)`	affected	code_commit	—
`[577dbc6c656da6997dddc6cf842b7954588f2d4e,7ae7b093b7dba9548a3bc4766b9364b97db4732d)`	affected	code_commit	—
`[577dbc6c656da6997dddc6cf842b7954588f2d4e,7b692dff8df0ba5feb8df00f27d906d6eb1fe627)`	affected	code_commit	—
`[577dbc6c656da6997dddc6cf842b7954588f2d4e,9612d91f617231e03c49cb9b0c02f975a3b4f51f)`	affected	code_commit	—
`[577dbc6c656da6997dddc6cf842b7954588f2d4e,0fb3b94a9431a3800717e5c3b6fa2e1045a15029)`	affected	code_commit	—
`[577dbc6c656da6997dddc6cf842b7954588f2d4e,4e10a730d1b511ff49723371ed6d694dd1b2c785)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.10`	affected	generic	—
`[0,5.10)`	unaffected	generic	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.77,6.13.0)`	unaffected	semver	—
`[6.18.17,6.19.0)`	unaffected	semver	—
`[6.19.7,6.20.0)`	unaffected	semver	—
`[7.0-rc3,*)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that includes the commit fixing the out‑of‑bounds access.

Generated by OpenCVE AI on March 26, 2026 at 14:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00032.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0fb3b94a9431a3800717e5c3b6fa2e1045a15029
https://git.kernel.org/stable/c/4e10a730d1b511ff49723371ed6d694dd1b2c785
https://git.kernel.org/stable/c/7ae7b093b7dba9548a3bc4766b9364b97db4732d
https://git.kernel.org/stable/c/7b692dff8df0ba5feb8df00f27d906d6eb1fe627
https://git.kernel.org/stable/c/84419556359bc96d3fe1623d47a64c86542566cc
https://git.kernel.org/stable/c/9612d91f617231e03c49cb9b0c02f975a3b4f51f
https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23315-9ac1@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23315
https://www.cve.org/CVERecord?id=CVE-2026-23315

History

Thu, 23 Apr 2026 21:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
CPEs		cpe:2.3:o:linux:linux_kernel:5.10:-:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}`

Thu, 26 Mar 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Thu, 26 Mar 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://lore.kernel.org/linux-cve-announce/2026032529-CVE-2026-23315-9ac1@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23315 https://www.cve.org/CVERecord?id=CVE-2026-23315
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 25 Mar 2026 22:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Wed, 25 Mar 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt76_connac2_mac_write_txwi_80211 in order to avoid a possible oob access. [fix check to also cover mgmt->u.action.u.addba_req.capab, correct Fixes tag]
Title		wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0fb3b94a9431a3800717e5c3b6fa2e1045a15029 https://git.kernel.org/stable/c/4e10a730d1b511ff49723371ed6d694dd1b2c785 https://git.kernel.org/stable/c/7ae7b093b7dba9548a3bc4766b9364b97db4732d https://git.kernel.org/stable/c/7b692dff8df0ba5feb8df00f27d906d6eb1fe627 https://git.kernel.org/stable/c/84419556359bc96d3fe1623d47a64c86542566cc https://git.kernel.org/stable/c/9612d91f617231e03c49cb9b0c02f975a3b4f51f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-03-25T10:27:10.115Z

Updated: 2026-04-13T06:04:14.195Z

Reserved: 2026-01-13T15:37:45.994Z

Link: CVE-2026-23315

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-03-25T11:16:27.897

Modified: 2026-04-23T21:06:57.390

Link: CVE-2026-23315

Redhat

Severity : Moderate

Publid Date: 2026-03-25T00:00:00Z

Links: CVE-2026-23315 - Bugzilla

OpenCVE Enrichment

Updated: 2026-03-27T09:49:55Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object