The vulnerability occurs in the MediaTek mt7925 wireless driver for Linux, where a firmware‑returned buffer is copied into a fixed‑size array without checking its length. The 512‑byte memcpy starts eight bytes past the start of the buffer; if the firmware sends less than 520 bytes, the driver reads beyond the buffer’s end. The over‑read data is then passed to userspace through a netlink attribute, allowing an attacker to read arbitrary kernel memory that should be protected.

All Linux kernel builds that contain the mt76/mt7925 driver are affected. This includes any system running an unpatched kernel where the driver is active for a MediaTek wireless device. The advisory does not specify a version range, but the fix is present in the kernel source after the dates of the listed commit references.

The flaw is an out‑of‑bounds read (CWE‑125/CWE‑119). The CVSS score is 5.5 and the EPSS score is below 1 %, with the vulnerability not listed in CISA KEV, indicating no known active exploitation yet. An attacker would likely need to trigger a testmode query via the wireless stack, which may require privileged or local access to the device. If exploited, the attacker could leak kernel data, leading to a confidentiality breach. The lack of public exploitation data suggests the risk is primarily theoretical but significant enough for affected users to patch.