{"apiVersion":"1.0","identifier":"CVE-2026-74324","description":"In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925_tm_query(), the response skb from mt76_mcu_send_and_get_msg() is used in a memcpy without validating its length: memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN); where MT7925_EVT_RSP_LEN is 512. If the firmware returns a response shorter than 520 bytes (8 + 512), this reads beyond the skb data buffer. The over-read data is then returned to userspace via nla_put() in mt7925_testmode_dump(). Add a length check before the memcpy to ensure the skb contains sufficient data.","publishedAt":"2026-08-15T06:22:33","lastModifiedAt":"2026-08-17T06:19:26","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74324","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00166,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74324","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74324","en":"https://www.redsauce.net/en/cves/CVE-2026-74324","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74324","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74324","de":"https://www.redsauce.net/de/cves/CVE-2026-74324","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74324","el":"https://www.redsauce.net/el/cves/CVE-2026-74324"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74324"}}