vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-98159

wifi: mt76: mt7921: validate CLC firmware records

MEDIUM
5.5
CVSS Score
Published: September 25, 2026 at 10:36 AM UTC
Updated: October 19, 2026 at 10:18 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: validate CLC firmware records The CLC region is supplied by firmware, but the loader trusts the region count and each record length. A malformed image can make the region table pointer precede the firmware buffer, make the record loop fail to advance, or index phy->clc past its end. Validate the table and record bounds before dereferencing or copying.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
6.1 ≤ v < 6.1.1896.12 ≤ v < 6.12.1116.18 ≤ v < 6.18.536.6 ≤ v < 6.6.1587.2 ≤ v < 7.2.723bdc5d8cadfc941e7782d0cb8afb2d9ae73b1256.1
Vendor states this is fixed in 3896be051e928c891922d91de94c99519d215dff (fixed)
Vendor states this is fixed in 3c505e2af16a9320f4355218394a955fbbc65322 (fixed)
Vendor states this is fixed in 46673662402884ca55a869e4ebe956e08e8b6b05 (fixed)
Vendor states this is fixed in 602a950134ee2940136f60797e4457c3983b06ce (fixed)
Vendor states this is fixed in 740272d46ffc8231709a5e774cf5e4a5785b8a02 (fixed)
Vendor states this is fixed in 9417c5818a0146980c2608fda94c908e604eb033 (fixed)
Vendor states this is fixed in 6.1 (unaffected)
Vendor states this is fixed in 6.1.189 (unaffected)
Vendor states this is fixed in 6.12.111 (unaffected)
Vendor states this is fixed in 6.18.53 (unaffected)
Vendor states this is fixed in 6.6.158 (unaffected)
Vendor states this is fixed in 7.2.7 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc1 (unaffected)

References (6)

Patch
Source: cverecord
https://git.kernel.org/stable/c/602a950134ee2940136f60797e4457c3983b06ce
Patch
Source: cverecord
https://git.kernel.org/stable/c/3896be051e928c891922d91de94c99519d215dff
Patch
Source: cverecord
https://git.kernel.org/stable/c/3c505e2af16a9320f4355218394a955fbbc65322
Patch
Source: cverecord
https://git.kernel.org/stable/c/9417c5818a0146980c2608fda94c908e604eb033
Patch
Source: cverecord
https://git.kernel.org/stable/c/46673662402884ca55a869e4ebe956e08e8b6b05
Patch
Source: cverecord
https://git.kernel.org/stable/c/740272d46ffc8231709a5e774cf5e4a5785b8a02

CVSS

5.5MEDIUM[email protected]
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-787

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card