CVE-2024-57990 (GCVE-0-2024-57990)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:07 – Updated: 2026-08-05 11:47
VLAI
Title
wifi: mt76: mt7925: fix off by one in mt7925_load_clc()
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() This comparison should be >= instead of > to prevent an out of bounds read and write.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9679ca7326e52282cc923c4d71d81c999cb6cd55 , < d03b8fe1b518fc2ea2d82588e905f56d80cd64b2 (git)
Affected: 9679ca7326e52282cc923c4d71d81c999cb6cd55 , < 2d1628d32300e4f67ac0b7409cbfa7b912a8fe9d (git)
Affected: 9679ca7326e52282cc923c4d71d81c999cb6cd55 , < 08fa656c91fd5fdf47ba393795b9c0d1e97539ed (git)
Affected: fb60020cb5b3ea4715e538c77e745c16516c5656 (git)
Affected: ba09084d81c6480bd02fd74052045e533a5e8469 (git)
Affected: 6.10.13 , < 6.11 (semver)
Affected: 6.11.2 , < 6.12 (semver)
Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.13 , ≤ 6.12.* (semver)
Unaffected: 6.13.2 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-57990",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:31:30.704043Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-193",
                "description": "CWE-193 Off-by-one Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:36:42.699Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7925/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d03b8fe1b518fc2ea2d82588e905f56d80cd64b2",
              "status": "affected",
              "version": "9679ca7326e52282cc923c4d71d81c999cb6cd55",
              "versionType": "git"
            },
            {
              "lessThan": "2d1628d32300e4f67ac0b7409cbfa7b912a8fe9d",
              "status": "affected",
              "version": "9679ca7326e52282cc923c4d71d81c999cb6cd55",
              "versionType": "git"
            },
            {
              "lessThan": "08fa656c91fd5fdf47ba393795b9c0d1e97539ed",
              "status": "affected",
              "version": "9679ca7326e52282cc923c4d71d81c999cb6cd55",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fb60020cb5b3ea4715e538c77e745c16516c5656",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ba09084d81c6480bd02fd74052045e533a5e8469",
              "versionType": "git"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7925/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.13",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7925: fix off by one in mt7925_load_clc()\n\nThis comparison should be \u003e= instead of \u003e to prevent an out of bounds\nread and write."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The out-of-bounds index comes from the CLC region of the firmware image parsed by request_firmware() during local device probe or chip reset, not from any network or radio input. Reaching the vulnerable parser requires local system access to supply or influence the firmware blob and trigger driver initialization.\nAC:L - Once a firmware image containing a CLC entry with idx == 2 is present, the off-by-one triggers deterministically on every probe or chip reset with no timing, race, or memory-layout condition outside the attacker\u0027s control. The offending value is a single byte in the blob.\nPR:L - Consistent with how firmware-blob parsing flaws are scored in this tree (mdt_loader, venus hfi_parser), the attacker is a low-privileged local actor able to influence the firmware image consumed by the driver; no capability check guards mt7925_load_clc() itself. The parse also runs automatically on the reset path, which an adjacent attacker can provoke by forcing a firmware assert.\nUI:N - mt7925_load_clc() runs unconditionally from mt7925_run_firmware() during PCIe probe at boot/module load and again on mt7925_mac_reset(), so no victim action is required. The corruption occurs as part of normal driver bring-up.\nS:U - The out-of-bounds read and write stay within the kernel\u0027s own security authority, corrupting struct mt792x_phy in kernel memory. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The commit explicitly fixes an out-of-bounds read; phy-\u003eclc[2] reads kernel memory beyond the array, and the resulting heap-pointer state feeds capability decisions. Per kernel scoring guidance, out-of-bounds reads and memory corruption that can be leveraged for disclosure are rated High.\nI:H - phy-\u003eclc[2] = devm_kmemdup(...) is an out-of-bounds write that overwrites the adjacent u64 chip_cap with a kernel heap pointer, silently setting capability bits such as MT792x_CHIP_CAP_MLO_EVT_EN and MT792x_CHIP_CAP_CLC_EVT_EN. Out-of-bounds writes and the resulting kernel-state corruption are rated High.\nA:H - Corrupted chip_cap makes the driver advertise WIPHY_FLAG_SUPPORTS_MLO and enter MLO/CLC handling that the running firmware does not support, and the same loop copies firmware-controlled lengths from an out-of-bounds entry, leading to oops or driver/firmware failure. Any such kernel crash or hang is rated High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:13.777Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d03b8fe1b518fc2ea2d82588e905f56d80cd64b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d1628d32300e4f67ac0b7409cbfa7b912a8fe9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/08fa656c91fd5fdf47ba393795b9c0d1e97539ed"
        }
      ],
      "title": "wifi: mt76: mt7925: fix off by one in mt7925_load_clc()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57990",
    "datePublished": "2025-02-27T02:07:13.010Z",
    "dateReserved": "2025-02-27T02:04:28.914Z",
    "dateUpdated": "2026-08-05T11:47:13.777Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-57990",
      "date": "2026-08-06",
      "epss": "0.00234",
      "percentile": "0.14341"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-57990\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-27T02:15:13.010\",\"lastModified\":\"2026-06-17T08:14:23.597\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mt76: mt7925: fix off by one in mt7925_load_clc()\\n\\nThis comparison should be \u003e= instead of \u003e to prevent an out of bounds\\nread and write.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: mt76: mt7925: correcci\u00f3n de uno en mt7925_load_clc(). Esta comparaci\u00f3n debe ser \u0026gt;= en lugar de \u0026gt; para evitar una lectura y escritura fuera de los l\u00edmites.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/wireless/mediatek/mt76/mt7925/mcu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9679ca7326e52282cc923c4d71d81c999cb6cd55\",\"lessThan\":\"d03b8fe1b518fc2ea2d82588e905f56d80cd64b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9679ca7326e52282cc923c4d71d81c999cb6cd55\",\"lessThan\":\"2d1628d32300e4f67ac0b7409cbfa7b912a8fe9d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9679ca7326e52282cc923c4d71d81c999cb6cd55\",\"lessThan\":\"08fa656c91fd5fdf47ba393795b9c0d1e97539ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb60020cb5b3ea4715e538c77e745c16516c5656\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ba09084d81c6480bd02fd74052045e533a5e8469\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.10.13\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.11.2\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/wireless/mediatek/mt76/mt7925/mcu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.13\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.2\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:31:30.704043Z\",\"id\":\"CVE-2024-57990\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-193\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-193\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10.13\",\"versionEndExcluding\":\"6.11\",\"matchCriteriaId\":\"B88D322F-6F03-45A1-8C58-9E45EAB64B13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11.2\",\"versionEndExcluding\":\"6.12.13\",\"matchCriteriaId\":\"36A302E0-25BB-4336-8320-055552CC64E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.2\",\"matchCriteriaId\":\"6D4116B1-1BFD-4F23-BA84-169CC05FC5A3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08fa656c91fd5fdf47ba393795b9c0d1e97539ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2d1628d32300e4f67ac0b7409cbfa7b912a8fe9d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d03b8fe1b518fc2ea2d82588e905f56d80cd64b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T22:59:50+00:00",
      "cve": "CVE-2024-57990",
      "id": "CVE-2024-57990",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:fixed": "303",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mt76: mt7925: fix off by one in mt7925_load_clc()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-57990.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-57990\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:31:30.704043Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-193\", \"description\": \"CWE-193 Off-by-one Error\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:54:42.279Z\"}}], \"cna\": {\"title\": \"wifi: mt76: mt7925: fix off by one in mt7925_load_clc()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The out-of-bounds index comes from the CLC region of the firmware image parsed by request_firmware() during local device probe or chip reset, not from any network or radio input. Reaching the vulnerable parser requires local system access to supply or influence the firmware blob and trigger driver initialization.\\nAC:L - Once a firmware image containing a CLC entry with idx == 2 is present, the off-by-one triggers deterministically on every probe or chip reset with no timing, race, or memory-layout condition outside the attacker\u0027s control. The offending value is a single byte in the blob.\\nPR:L - Consistent with how firmware-blob parsing flaws are scored in this tree (mdt_loader, venus hfi_parser), the attacker is a low-privileged local actor able to influence the firmware image consumed by the driver; no capability check guards mt7925_load_clc() itself. The parse also runs automatically on the reset path, which an adjacent attacker can provoke by forcing a firmware assert.\\nUI:N - mt7925_load_clc() runs unconditionally from mt7925_run_firmware() during PCIe probe at boot/module load and again on mt7925_mac_reset(), so no victim action is required. The corruption occurs as part of normal driver bring-up.\\nS:U - The out-of-bounds read and write stay within the kernel\u0027s own security authority, corrupting struct mt792x_phy in kernel memory. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The commit explicitly fixes an out-of-bounds read; phy-\u003eclc[2] reads kernel memory beyond the array, and the resulting heap-pointer state feeds capability decisions. Per kernel scoring guidance, out-of-bounds reads and memory corruption that can be leveraged for disclosure are rated High.\\nI:H - phy-\u003eclc[2] = devm_kmemdup(...) is an out-of-bounds write that overwrites the adjacent u64 chip_cap with a kernel heap pointer, silently setting capability bits such as MT792x_CHIP_CAP_MLO_EVT_EN and MT792x_CHIP_CAP_CLC_EVT_EN. Out-of-bounds writes and the resulting kernel-state corruption are rated High.\\nA:H - Corrupted chip_cap makes the driver advertise WIPHY_FLAG_SUPPORTS_MLO and enter MLO/CLC handling that the running firmware does not support, and the same loop copies firmware-controlled lengths from an out-of-bounds entry, leading to oops or driver/firmware failure. Any such kernel crash or hang is rated High.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9679ca7326e52282cc923c4d71d81c999cb6cd55\", \"lessThan\": \"d03b8fe1b518fc2ea2d82588e905f56d80cd64b2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9679ca7326e52282cc923c4d71d81c999cb6cd55\", \"lessThan\": \"2d1628d32300e4f67ac0b7409cbfa7b912a8fe9d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9679ca7326e52282cc923c4d71d81c999cb6cd55\", \"lessThan\": \"08fa656c91fd5fdf47ba393795b9c0d1e97539ed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fb60020cb5b3ea4715e538c77e745c16516c5656\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ba09084d81c6480bd02fd74052045e533a5e8469\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.10.13\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.11.2\", \"lessThan\": \"6.12\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/wireless/mediatek/mt76/mt7925/mcu.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/wireless/mediatek/mt76/mt7925/mcu.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d03b8fe1b518fc2ea2d82588e905f56d80cd64b2\"}, {\"url\": \"https://git.kernel.org/stable/c/2d1628d32300e4f67ac0b7409cbfa7b912a8fe9d\"}, {\"url\": \"https://git.kernel.org/stable/c/08fa656c91fd5fdf47ba393795b9c0d1e97539ed\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mt76: mt7925: fix off by one in mt7925_load_clc()\\n\\nThis comparison should be \u003e= instead of \u003e to prevent an out of bounds\\nread and write.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.13\", \"versionStartIncluding\": \"6.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.2\", \"versionStartIncluding\": \"6.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"6.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.10.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.11.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:47:13.777Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-57990\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:47:13.777Z\", \"dateReserved\": \"2025-02-27T02:04:28.914Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-27T02:07:13.010Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.