---
id: CVE-2026-80937
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

  mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's
  dev->mt76.eeprom.data bu…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

  mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's
  dev->mt76.eeprom.data bu…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e57b7901469fc0b021930b83a8094baaf3d81b09 <
    394e8cb56fc732d71041599cdb4e01f82cfd11c5
  - >-
    Linux >= e57b7901469fc0b021930b83a8094baaf3d81b09 <
    5fdaf7016d7684ef756a229fd5d96b4a140eeb40
  - >-
    Linux >= e57b7901469fc0b021930b83a8094baaf3d81b09 <
    5f48b0d752a76590e2c613aae5345c2474627d1b
  - >-
    Linux >= e57b7901469fc0b021930b83a8094baaf3d81b09 <
    44b5adfe49499f53002737f5fe81d608c08122fc
  - Linux 5.8
published: '2026-09-11'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:17:41.193'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80937'
references:
  - url: 'https://git.kernel.org/stable/c/394e8cb56fc732d71041599cdb4e01f82cfd11c5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/44b5adfe49499f53002737f5fe81d608c08122fc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5f48b0d752a76590e2c613aae5345c2474627d1b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5fdaf7016d7684ef756a229fd5d96b4a140eeb40'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80937.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80937'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532388'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80937'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80937'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80937.mbox
  - url: 'https://git.kernel.org/stable/c/d6774f6af3711143a93281904a928a78652c8b7e'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00344
epssPercentile: 0.27734
scores:
  nvd: 8.8
  vendor: 5.5
  cna: 8.8
ingestedAt: '2026-09-14T15:23:07.476Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy

mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's
dev->mt76.eeprom.data buffer at the offset reported by the MCU response
(res->addr, a device-controlled __le32) without checking it against the
buffer size. A malicious or malfunctioning device can report an arbitrary
address and drive a 16-byte out-of-bounds write past eeprom.data.

Reject a response whose address would place the copy outside eeprom.data
before deriving the destination pointer. Devices that echo the requested
in-bounds offset are unaffected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80937.json)