A high-severity out-of-bounds write vulnerability in the Linux kernel Wi-Fi driver could allow a malicious hardware device to achieve arbitrary memory corruption.

The mt7996_mcu_get_eeprom function fails to properly validate the destination address provided by a device MCU response before performing a memory copy. This lack of bounds checking allows a device to trigger an out-of-bounds write, which can be exploited by an unauthenticated attacker or a compromised peripheral device to overwrite kernel memory.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for significant impact including system instability, denial of service, or potential privilege escalation. Successful exploitation by a malicious device could lead to a complete compromise of the host system, resulting in data loss or unauthorized access to sensitive kernel-level operations.

Immediate Action: Update the Linux kernel to version 7.2.4 or later, or apply the upstream patches identified in the official kernel git repository.

Proactive Monitoring: Monitor system logs for kernel panic events or unexpected driver-related errors that may indicate attempts to exploit the mt7996 driver.

Compensating Controls: Restrict access to untrusted Wi-Fi hardware or peripherals that interact with the mt7996 driver, as the attack vector requires a device that can communicate with the kernel driver.

Public Exploit Available: Unknown

Given the critical nature of kernel-level vulnerabilities, organizations should prioritize patching the Linux kernel to version 7.2.4 or applying the provided fixes. Failure to address this flaw could allow attackers to leverage hardware peripherals to gain unauthorized control over the operating system environment.