CVE-2026-74324 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: validate skb length in testmode query
In mt7925_tm_query(), the response skb from mt76_mcu_send_and_get_msg() is used in a memcpy without validating its length:
memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN);
where MT7925_EVT_RSP_LEN is 512. If the firmware returns a response shorter than 520 bytes (8 + 512), this reads beyond the skb data buffer. The over-read data is then returned to userspace via nla_put() in mt7925_testmode_dump().
Add a length check before the memcpy to ensure the skb contains sufficient data.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability exists within the mt7925 wireless driver component of the linux kernel, specifically in the testmode query functionality that handles communication with MediaTek mt7925 wireless chips. This issue represents a classic buffer over-read condition that occurs when processing responses from firmware components. The flaw manifests in the mt7925_tm_query() function where response data is retrieved from the firmware through mt76_mcu_send_and_get_msg() and subsequently copied into a fixed-size buffer without proper validation of the received data length.
The technical implementation involves a memcpy operation that copies 512 bytes from the response skb (socket buffer) starting at offset 8, assuming the buffer contains sufficient data. However, when firmware returns responses shorter than 520 bytes total (8 bytes header plus 512 bytes expected payload), the code reads beyond the allocated buffer boundaries. This over-read condition occurs because the system does not validate that the received skb contains at least 520 bytes before attempting the memory copy operation. The CWE-129 weakness category applies here as this represents an improper validation of the length parameter during buffer operations.
The operational impact of this vulnerability extends to potential information disclosure and system instability within wireless networking contexts. When the over-read occurs, arbitrary data from memory beyond the intended buffer boundaries gets copied into the response structure and subsequently returned to userspace through netlink attribute put operations. This could potentially expose sensitive kernel memory contents to unprivileged userspace processes that have access to the testmode interface, creating a vector for information leakage attacks. The ATT&CK framework classification would place this under privilege escalation or information gathering techniques where attackers might exploit such memory corruption to extract kernel memory contents.
The mitigation strategy requires implementing proper bounds checking before any memory operations occur. Adding a length validation check prior to the memcpy operation ensures that the skb contains sufficient data before attempting to copy from it. This approach aligns with secure coding practices and follows the principle of least privilege by preventing unauthorized access to kernel memory regions. The fix should validate that the received skb length is at least 520 bytes before proceeding with the memory copy, thereby preventing the over-read condition while maintaining the driver's functionality for legitimate operations.