CVE-2024-57990

CVE-2024-57990 is an off-by-one vulnerability in the Linux kernel's mt76 WiFi driver, specifically affecting the mt7925 chipset in the mt7925_load_clc() function. The flaw stems from an incorrect comparison using ">" instead of ">=", which allows an out-of-bounds read and write. This issue is classified under CWE-193 (Off-by-One Error) with a CVSS v3.1 base score of 7.8.

A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Successful exploitation enables high-impact confidentiality, integrity, and availability violations, potentially allowing arbitrary code execution, data corruption, or system crashes within the kernel context.

The vulnerability has been addressed in stable kernel releases via patches available at kernel.org git repositories, including commits 08fa656c91fd5fdf47ba393795b9c0d1e97539ed, 2d1628d32300e4f67ac0b7409cbfa7b912a8fe9d, and d03b8fe1b518fc2ea2d82588e905f56d80cd64b2. Security practitioners should update affected Linux kernels to incorporate these fixes to mitigate the risk.