CVE-2026-23363

A flaw was found in the Linux kernel's mt76 wireless driver, specifically within the mt7925 component. This vulnerability arises from a failure to properly check the frame length before accessing management fields in the mt7925_mac_write_txwi_80211() function. An attacker could potentially exploit this to trigger an out-of-bounds memory access, which may lead to system instability or other unpredictable behavior.

This flaw affects systems with MediaTek MT7925 wireless adapters. The missing frame length check in mt7925_mac_write_txwi_80211() allows OOB access when processing malformed management frames. Exploitation requires the ability to inject crafted wireless frames, which may be possible over the air depending on the wireless configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the mt7925e or mt7925u module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.