The Linux kernel mt76 wifi driver for the mt7996 device had a vulnerability where the function mt7996_mcu_get_eeprom() used a device-controlled address (event->addr) to determine the destination for copying EFUSE/EXT EEPROM blocks. The driver only clamped the copy length but did not clamp the destination offset into dev->mt76.eeprom.data, allowing a malicious or malfunctioning device to specify an arbitrary address and cause an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes beyond the EEPROM data buffer. The fix involves rejecting any response whose address would place the copy outside the EEPROM data buffer before calculating the destination pointer. Devices that correctly echo the requested in-bounds offset are not affected.

A malicious or malfunctioning device can cause an out-of-bounds write in kernel memory, potentially leading to memory corruption. The exact impact depends on the context and exploitation but could include system instability or privilege escalation. No known exploits in the wild have been reported.

The vulnerability has been resolved by adding a check to reject any EEPROM copy response with an address outside the valid EEPROM data range. Users should apply the official Linux kernel update that includes this fix. No additional mitigation is required for devices that echo the requested in-bounds offset.