The Linux kernel mt76 wireless driver for the mt7996 chipset contained a vulnerability where the function mt7996_mac_write_txwi_80211() did not properly check the frame length before accessing management fields, potentially causing an out-of-bounds memory access. This could lead to memory corruption or system instability. The issue affects multiple Linux kernel versions prior to 6.8.0-1064.72~22.04.1 and related builds. The vulnerability has been assigned CVE-2026-23325 with a CVSS v3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H), indicating local attack vector with low attack complexity and privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. The vendor has released patches in Linux kernel 6.8.0 and later versions to address this issue. The Ubuntu security advisories USN-8567-1 and USN-8574-1 provide detailed information and remediation instructions.

Successful exploitation of this vulnerability could allow a local attacker with limited privileges to cause out-of-bounds memory access in the mt7996 wireless driver, potentially leading to system crashes or denial of service (high availability impact) and exposure of sensitive information (high confidentiality impact). There is no indication of integrity impact. The vulnerability does not require user interaction and has low attack complexity but requires local access and privileges.

A patch is available for this vulnerability. Users should update their Linux kernel to versions 6.8.0-1064.72~22.04.1 or later as provided by their distribution vendor, such as through the Ubuntu security notices USN-8567-1 and USN-8574-1. After applying the update, a system reboot is required to complete the remediation. Due to an ABI change in the kernel update, recompilation and reinstallation of any third-party kernel modules may be necessary. Follow vendor instructions carefully to ensure full mitigation.