https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:08:19 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74324 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: mt76: mt7925: validate skb length in testmode query</p> <p>In mt7925_tm_query(), the response skb from mt76_mcu_send_and_get_msg() is used in a memcpy without validating its length:</p> <p>memcpy(evt_resp, skb-&gt;data + 8, MT7925_EVT_RSP_LEN);</p> <p>where MT7925_EVT_RSP_LEN is 512. If the firmware returns a response shorter than 520 bytes (8 + 512), this reads beyond the skb data buffer. The over-read data is then returned to userspace via nla_put() in mt7925_testmode_dump().</p> <p>Add a length check before the memcpy to ensure the skb contains sufficient data.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: mt76: mt7925: validate skb length in testmode query</p> <p>In mt7925_tm_query(), the response skb from mt76_mcu_send_and_get_msg() is used in a memcpy without validating its length:</p> <p>memcpy(evt_resp, skb-&gt;data + 8, MT7925_EVT_RSP_LEN);</p> <p>where MT7925_EVT_RSP_LEN is 512. If the firmware returns a response shorter than 520 bytes (8 + 512), this reads beyond the skb data buffer. The over-read data is then returned to userspace via nla_put() in mt7925_testmode_dump().</p> <p>Add a length check before the memcpy to ensure the skb contains sufficient data.</p> https://vulnerability.circl.lu/vuln/cve-2026-74324