PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46136 Linux CVE debrief

A vulnerability in the Linux kernel's MediaTek MT7921 Wi-Fi driver (mt76) could cause driver initialization failure or near-infinite loop conditions. The issue stems from an integer underflow in buffer length handling when processing Country Location Configuration (CLC) power table data. When buf_len underflows during country power setting retrieval, the driver may either loop excessively or load invalid power settings, preventing successful Wi-Fi initialization on affected systems.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

Organizations and individuals running Linux systems with MediaTek MT7921 Wi-Fi chipsets, including laptops and embedded devices using this wireless hardware. Cloud infrastructure providers offering bare-metal or VM instances with passthrough MT7921 devices. IoT and edge computing deployments utilizing MT7921-based wireless connectivity.

Technical summary

The mt7921 driver in the Linux kernel's mt76 wireless stack contains a buffer length underflow vulnerability in Country Location Configuration (CLC) processing. The buf_len variable, used to bound iterations during country power setting retrieval, can underflow when processing certain power table configurations. This underflow results in either: (1) an effectively infinite loop due to the underflowed value being interpreted as a very large unsigned integer, or (2) loading of invalid power settings that cause driver initialization failure. The vulnerability is triggered during driver initialization when parsing CLC data from firmware. The fix implements proper bounds checking to prevent the underflow condition.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the mt7921 CLC buffer length fix when available from your Linux distribution
  • Monitor stable kernel releases for commits addressing CVE-2026-46136
  • For systems using MediaTek MT7921 Wi-Fi hardware, verify driver initialization logs for power setting errors as potential indicators of this issue
  • Review vendor security advisories for distribution-specific patch availability

Evidence notes

The vulnerability description indicates this is a resolved kernel issue affecting the mt7921 driver specifically. The fix addresses buffer length validation in CLC power table parsing. Multiple stable kernel commits are referenced, suggesting backports to various kernel versions.

Official resources

2026-05-28