CVE-2026-46136

Technical summary

CVE-2026-46136 is a buffer length underflow vulnerability in the Linux kernel's mt76 driver for MediaTek MT7921 Wi-Fi chipsets. The vulnerability exists in the country power setting retrieval logic within the CLC (Carrier List Configuration) handling code. The buf_len variable, which bounds iteration when parsing power table entries, can underflow due to structural changes in the CLC power table data. This underflow bypasses intended loop termination checks, leading to either an indefinite loop consuming CPU resources or the application of out-of-bounds power settings that cause driver initialization to fail. The root cause is insufficient validation of the buffer size against consumed data before decrementing the length counter.

Business impact

Systems running affected Linux kernels with MT7921 Wi-Fi hardware will experience driver initialization failures or intermittent Wi-Fi outages triggered by malformed or adversarial CLC data. For endpoint devices, this prevents network connectivity; for servers or edge appliances relying on Wi-Fi, this creates availability risk. The denial-of-service vector requires local privilege or ability to influence firmware/configuration data, limiting remote exploitability but increasing insider risk in multi-tenant or bring-your-own-device environments. Organizations with MT7921-based systems should prioritize patching to restore stable wireless operations.

Affected systems

The vulnerability affects Linux kernel versions running on systems with MediaTek MT7921 Wi-Fi chipsets. This includes consumer laptops, tablets, and edge devices that use MT7921 for Wi-Fi connectivity. Verify your kernel version and confirm MT7921 presence via lspci or lsusb; affected systems will report the mt76 or mt7921 driver. The vulnerability does not affect systems using alternative Wi-Fi chipsets or those running Windows, macOS, or other operating systems.

Exploitability

Exploitability is moderate and requires local access. An attacker must either hold local unprivileged user privileges or control Wi-Fi configuration data (CLC tables) to trigger the underflow. Since CLC data is typically loaded from firmware or regulatory databases, exploitation paths include: (1) a privileged local user crafting malformed CLC data, (2) supply-chain compromise of firmware, or (3) a guest or unprivileged account triggering the flaw via configuration APIs if the driver reloads CLC on certain events. Remote exploitation is not credible under normal conditions. This is not listed on CISA's KEV catalog, indicating limited evidence of active, weaponized attacks in the wild as of the publication date.

Remediation

Apply a kernel update that includes the fix for mt76 MT7921 CLC buffer handling. The patch adds proper bounds checking before each buffer length decrement and validates CLC table structure before processing power entries. Verify the patch against your Linux distribution's advisory; common vendors (Ubuntu, Red Hat, Debian) typically backport this to stable and LTS kernel branches. After patching, recompile the kernel or install the distribution's prebuilt image, then reboot to activate the fix.

Patch guidance

Obtain the patched kernel from your distribution's security channel. For Ubuntu: check security.ubuntu.com for linux-image packages with the mt76 fix. For Red Hat/CentOS: consult security.redhat.com and use 'yum update kernel' or 'dnf update kernel'. For Debian: update from the security suite. Verify patch application by comparing your kernel version against the advisory timeline; the fix was merged upstream around the 2026-05-28 publication date. Test in a non-production environment first, especially if custom kernel configurations are in use.

Detection guidance

Monitor system logs for mt7921 driver initialization failures or repeated 'clc buffer underflow' warnings. In dmesg or journalctl, look for messages mentioning 'mt7921', 'CLC', or 'power setting' errors during driver load. Devices with the vulnerability may show Wi-Fi as present but non-functional. Use 'ethtool -d' or vendor diagnostic tools to inspect driver state. On vulnerable systems, triggering a reload of the regulatory domain (via 'iw reg set') may reproduce the failure. Endpoint detection tools should flag systems where mt76 driver errors correlate with Wi-Fi outages.

Why prioritize this

This vulnerability scores HIGH (CVSS 7.8) and warrants prompt patching because it directly impacts system availability and can be triggered by local users with minimal privilege. While not yet in active exploit campaigns (KEV status: false), the combination of ease of local triggering, impact on critical wireless connectivity, and presence in mainstream Linux distributions makes it a medium-to-high priority for organizations with MT7921 deployments. Prioritize over purely remote vulnerabilities but behind any actively exploited KEV items.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L) requiring user-level privileges (PR:L), no user interaction needed, uniform scope, and high impact across confidentiality, integrity, and availability (C:H, I:H, A:H). The 'A:H' impact rating is justified because the underflow causes denial of service via driver failure. The local requirement and privilege threshold prevent a perfect 10.0 but do not diminish the practical risk for systems where local users are not fully trusted or where configuration tampering is feasible.

Frequently asked questions