---
id: CVE-2026-80933
title: 'wifi: mt76: mt7996: validate default EEPROM firmware size'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mt76: mt7996: validate default EEPROM firmware size

  The default EEPROM firmware is parsed and copied as a full EEPROM
  without checking its length. A truncated fi…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-125
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 98686cd21624c75a043e96812beadddf4f6f48e5 <
    b4bf67cc0871b13103c404b38e332b9d4403a0da
  - >-
    Linux >= 98686cd21624c75a043e96812beadddf4f6f48e5 <
    127a291f4c8069a4e71906938402cacfe24ee8cd
  - >-
    Linux >= 98686cd21624c75a043e96812beadddf4f6f48e5 <
    03b81f015dbb29807ce1ec6d45537d658abdac69
  - >-
    Linux >= 98686cd21624c75a043e96812beadddf4f6f48e5 <
    7074ec3769820302f1ccf8794a40a6582153b820
  - >-
    Linux >= 98686cd21624c75a043e96812beadddf4f6f48e5 <
    653c6e289b13cc6942f3e8f8e3c568e70fa42d1f
  - Linux 6.2
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:45:17.026Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80933'
references:
  - url: 'https://git.kernel.org/stable/c/b4bf67cc0871b13103c404b38e332b9d4403a0da'
  - url: 'https://git.kernel.org/stable/c/127a291f4c8069a4e71906938402cacfe24ee8cd'
  - url: 'https://git.kernel.org/stable/c/03b81f015dbb29807ce1ec6d45537d658abdac69'
  - url: 'https://git.kernel.org/stable/c/7074ec3769820302f1ccf8794a40a6582153b820'
  - url: 'https://git.kernel.org/stable/c/653c6e289b13cc6942f3e8f8e3c568e70fa42d1f'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80933.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80933'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532333'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80933'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80933'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80933.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00129
epssPercentile: 0.02486
scores:
  cna: 7.8
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.455Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: validate default EEPROM firmware size

The default EEPROM firmware is parsed and copied as a full EEPROM
without checking its length. A truncated file can make the driver
read beyond the firmware buffer during variant validation or the
fallback copy.

Reject files shorter than MT7996_EEPROM_SIZE before parsing or
copying the firmware.

## Affected

- `Linux >= 98686cd21624c75a043e96812beadddf4f6f48e5 < b4bf67cc0871b13103c404b38e332b9d4403a0da`
- `Linux >= 98686cd21624c75a043e96812beadddf4f6f48e5 < 127a291f4c8069a4e71906938402cacfe24ee8cd`
- `Linux >= 98686cd21624c75a043e96812beadddf4f6f48e5 < 03b81f015dbb29807ce1ec6d45537d658abdac69`
- `Linux >= 98686cd21624c75a043e96812beadddf4f6f48e5 < 7074ec3769820302f1ccf8794a40a6582153b820`
- `Linux >= 98686cd21624c75a043e96812beadddf4f6f48e5 < 653c6e289b13cc6942f3e8f8e3c568e70fa42d1f`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80933.json)