A bug in the mt7996 Wi‑Fi driver allows an out‑of‑bounds read when the function mt7996_mac_write_txwi_80211() processes management frames. This weakness can expose kernel memory or corrupt state, leading to a denial of service or escalation of privilege if a malicious frame is crafted.

Linux kernel builds that contain the mt76 driver for the MT7996 wireless chipset are affected. The issue exists in any installation that uses the default kernel driver for this hardware. No specific kernel version ranges were supplied.

The flaw is unlikely to be widely exploited; EPSS scores are below 1% and it is not listed in CISA’s KEV database. However, an attacker could trigger the error by crafting a special WLAN management frame targeting the chip, which would require local network access or the ability to inject frames into the network interface. The severity appears moderate, but the low exploitation probability suggests that applying the fix promptly mitigates the risk.