The Wi‑Fi mt76/mt7996 driver fails to bound the destination offset when copying EFUSE data, allowing a malicious or malfunctioning device to request a copy to an arbitrary address. This results in an out‑of‑bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past the driver’s internal EEPROM buffer. The vulnerability can corrupt kernel memory, potentially leading to privilege escalation or system instability. It is an example of CWE‑787, an out‑of‑bounds write weakness.

All Linux systems running the latest kernel with the mt76 Wi‑Fi driver that includes the mt7996 controller. Devices that use the mt7996 chipset are affected if their kernel image does not incorporate the patch that bounds the EEPROM address.

The CVSS score of 6.4 indicates a moderate severity. EPSS is not available, so the publicly reported exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog. A likely attack vector involves a malicious or compromised Wi‑Fi device communicating with the affected driver, causing the out‑of-bounds copy. Because the flaw writes to kernel memory, an attacker could potentially gain arbitrary code execution if additional conditions (such as the ability to control the data written) are met.