A flaw in the Linux mt76 driver for the MT7996 wireless chipset allows the function mt7996_mac_write_txwi_80211() to read beyond the bounds of the incoming frame when the frame length is not validated. This out‑of‑bounds read (CWE‑125 and CWE‑805) can expose kernel memory contents or corrupt kernel state, potentially leading to system instability or unpredictable behavior.

All Linux kernel releases that include the mt76 driver for MT7996 and lack the length‑check patch are vulnerable. The affected versions are kernel 6.2 and the 7.0 release candidates 1 through 7, as defined by the CPE entries.

The CVSS score of 7.1 indicates moderate severity, while the EPSS score of less than 1% and absence from CISA’s KEV catalog suggest a low likelihood of widespread exploitation. The attack vector is inferred from the nature of the vulnerability: an attacker would need to transmit a specially crafted WLAN management frame to the target device, implying either local network proximity or the ability to inject frames into the victim’s wireless interface. Given these constraints, the potential impact remains moderate with a low probability of exploitation.