The Linux kernel mt76 driver for the mt7915 wifi device had a vulnerability where the function mt7915_mcu_get_eeprom() copied a fixed EFUSE block into the driver's EEPROM data buffer at an offset provided by the device's MCU response without verifying that the offset was within the buffer bounds. This allowed a malicious or malfunctioning device to specify an arbitrary address, causing a 16-byte out-of-bounds write past the eeprom.data buffer. The fix involves rejecting any response whose address would cause the copy to exceed the buffer size before performing the copy operation. Devices that correctly echo the requested in-bounds offset are not affected.

A malicious or malfunctioning wifi device could exploit this vulnerability to perform a 16-byte out-of-bounds write in kernel memory, potentially leading to memory corruption. The exact impact depends on the kernel's memory layout and usage of the eeprom.data buffer, but out-of-bounds writes can cause system instability or security issues such as privilege escalation or denial of service.

The vulnerability has been resolved by adding bounds checking on the EEPROM address before copying data. Users should apply the official Linux kernel update that includes this fix. No additional mitigation is required if the system is running the patched kernel version.