What’s Vulnerable › Vulnerabilities

CVE-2026-98159: wifi: mt76: mt7921: validate CLC firmware records

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-25 · updated 2026-10-19
• Weakness: CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: validate CLC firmware records The CLC region is supplied by firmware, but the loader trusts the region count and each record length. A malformed image can make the region table pointer precede the firmware buffer, make the record loop fail to advance, or index phy->clc past its end. Validate the table and record bounds before dereferencing or copying.

Affected products

• Linux kernel: from 6.1 before 6.1.189; from 6.6 before 6.6.158; from 6.12 before 6.12.111; from 6.18 before 6.18.53; from 7.2 before 7.2.7 — fixed in 6.1.189, 6.12.111, 6.18.53, 6.6.158, 7.2.7

How to fix

Upgrade to a fixed version: Linux kernel 6.1.189, 6.12.111, 6.18.53, 6.6.158. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/3896be051e928c891922d91de94c99519d215dff
• https://git.kernel.org/stable/c/3c505e2af16a9320f4355218394a955fbbc65322
• https://git.kernel.org/stable/c/46673662402884ca55a869e4ebe956e08e8b6b05
• https://git.kernel.org/stable/c/602a950134ee2940136f60797e4457c3983b06ce
• https://git.kernel.org/stable/c/740272d46ffc8231709a5e774cf5e4a5785b8a02
• https://git.kernel.org/stable/c/9417c5818a0146980c2608fda94c908e604eb033

Get alerted when CVE-2026-98159 or the next vulnerability affects your stack