GHSA-22XX-MMHM-WQ6H
Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-15 06:32
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: validate skb length in testmode query
In mt7925_tm_query(), the response skb from mt76_mcu_send_and_get_msg() is used in a memcpy without validating its length:
memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN);
where MT7925_EVT_RSP_LEN is 512. If the firmware returns a response shorter than 520 bytes (8 + 512), this reads beyond the skb data buffer. The over-read data is then returned to userspace via nla_put() in mt7925_testmode_dump().
Add a length check before the memcpy to ensure the skb contains sufficient data.
{
"affected": [],
"aliases": [
"CVE-2026-74324"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-15T06:22:33Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7925: validate skb length in testmode query\n\nIn mt7925_tm_query(), the response skb from mt76_mcu_send_and_get_msg()\nis used in a memcpy without validating its length:\n\n memcpy(evt_resp, skb-\u003edata + 8, MT7925_EVT_RSP_LEN);\n\nwhere MT7925_EVT_RSP_LEN is 512. If the firmware returns a response\nshorter than 520 bytes (8 + 512), this reads beyond the skb data\nbuffer. The over-read data is then returned to userspace via nla_put()\nin mt7925_testmode_dump().\n\nAdd a length check before the memcpy to ensure the skb contains\nsufficient data.",
"id": "GHSA-22xx-mmhm-wq6h",
"modified": "2026-08-15T06:32:30Z",
"published": "2026-08-15T06:32:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74324"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c386e90a7ce8ddec9f038e9437661a2821b0ce89"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c7369a00860a0704461d440e7c3bf9b49bfdbaee"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e8b214b6d6e1902025452db0a0af73dc9693e4ba"
}
],
"schema_version": "1.4.0",
"severity": []
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…