CVE-2026-23325: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23325 is an out-of-bounds read vulnerability in the Linux kernel's mt76 WiFi driver, specifically in the mt7996_mac_write_txwi_80211() function, caused by insufficient frame length validation before accessing management (mgmt) fields. It affects Linux kernel versions from 6.2.1 up to (but not including) 6.6.130, 6.7 up to 6.12.77, 6.13 up to 6.18.17, and 6.19 up to 6.19.7, as well as pre-release 7.0 release candidates prior to rc3. The vulnerability was published on March 25, 2026, with patches released on April 23, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (Red Hat CVE, Feedly).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-805 (Buffer Access with Incorrect Length Value). The vulnerability exists in the mt7996_mac_write_txwi_80211() function within the mt76/mt7996 WiFi driver, where the code accesses management frame fields without first verifying that the frame is long enough to contain those fields. A local attacker with low privileges could trigger this condition by supplying or causing the processing of a malformed or undersized 802.11 management frame, leading to a read beyond the allocated buffer boundary. The fix adds a frame length check before the mgmt field access (Red Hat CVE, Kernel Patch).

Successful exploitation of this vulnerability could result in kernel memory corruption, potentially causing system crashes (denial of service) or enabling local privilege escalation. The confidentiality and availability impacts are both rated High, as sensitive kernel memory contents may be exposed and system stability may be compromised. The integrity impact is rated None, and the scope is limited to the affected system without lateral movement potential in typical scenarios (Feedly, Red Hat CVE).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability requires local access with low privileges (no user interaction needed), limiting its remote exploitability. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

Upgrade the Linux kernel to one of the patched versions: 6.6.130, 6.12.77, 6.18.17, 6.19.7, or 7.0-rc3 or later. Distribution-specific updates are available from Red Hat, SUSE (SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), Debian (DSA-6238-1), and others. As a temporary workaround, restrict access to untrusted WiFi networks on systems using MT7996 WiFi adapters, and monitor for unexpected kernel crashes or suspicious WiFi stack behavior (Red Hat CVE, SUSE Advisory, Feedly).

The vulnerability has been tracked by major Linux distribution vendors including Red Hat, SUSE, and Debian, all of which have issued security advisories and kernel updates. Tenable has published detection plugins (Nessus plugin 303678 and 311299) for identifying vulnerable systems. No notable independent researcher commentary or significant social media discussion has been observed beyond standard distribution security channels (Red Hat CVE, SUSE Advisory, Debian Advisory).