An integer underflow vulnerability in the Linux kernel mt76 wifi driver allows adjacent attackers to trigger a denial of service or potentially disrupt wireless communication.

The vulnerability exists in the mt7915_mcu_get_sta_nss function within the mt76 wifi driver. When a peer provides an MCS map with no supported spatial streams, the driver incorrectly calculates the number of spatial streams, resulting in an underflow that causes an invalid value to be written to firmware beamforming fields. This is an unauthenticated, adjacent-network attack vector.

Successful exploitation of this vulnerability results in a denial of service for the wireless interface, potentially impacting connectivity for affected systems. While the CVSS score of 7.1 indicates a high severity due to the impact on availability (A:H) and integrity (I:L), the requirement for the attacker to be on the same local wireless network limits the blast radius. However, in environments where high availability of wireless infrastructure is critical, this flaw poses a notable operational risk.

Immediate Action: Update the Linux kernel to version 5.10.270, 5.15.221, 6.1.188, 6.6.157, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for repeated wifi driver crashes, firmware error messages, or unexpected resets of the wireless interface.

Compensating Controls: Ensure wireless networks are segmented and utilize strong authentication and encryption (WPA3) to limit the ability of unauthorized peers to communicate with the affected driver components.

Public Exploit Available: Unknown

Given the potential for denial of service on wireless infrastructure, organizations should prioritize patching affected Linux kernels during the next maintenance cycle. System administrators should verify their current kernel version and apply the upstream patches to ensure stability and resilience against potential exploitation.