# CVE-2026-80935: linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: mt76: mt7996: bound the device EEPROM addr...

CVE-2026-80935 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-80935, released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-80935
- Priority: High
- CVSS: 8.8 (high)
- EPSS: 0.0026
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 11, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy  mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr, a device-controlled __le32) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past eeprom.data.  Reject a response whose address would place the copy outside eeprom.data before deriving the destination pointer. Devices that echo the requested in-bounds offset are unaffected.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.113-1 | [DEBIAN-CVE-2026-80935](https://patchblox.com/security/data/fix/linux/debian-cve-2026-80935.md) | Sep 23, 2026 |
| Linux | linux Debian 14 | 7.2.6-1 | [DEBIAN-CVE-2026-80935](https://patchblox.com/security/data/fix/linux/debian-cve-2026-80935.md) | Sep 23, 2026 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.113-1~deb12u1 | [DEBIAN-CVE-2026-80935](https://patchblox.com/security/data/fix/linux/debian-cve-2026-80935.md) | Sep 23, 2026 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.