Linux Kernel mt76 Monitor Mode Crash Vulnerability in mt7921s Driver

A vulnerability in the Linux kernel's mt76 subsystem, specifically within the mt7921s driver, can lead to a crash in monitor mode. This issue arises when the driver receives frames with fragment buffers, particularly a CTS packet that is only 10 bytes long. The packet requires 6 bytes of header padding after the RXD buffer. However, the RXD is only in the first linear buffer. Pulling the buffer size of RXD minus the size plus 6 bytes with skb_pull() triggers a kernel bug due to the length of the skb being less than the data length. This vulnerability can cause a kernel crash, as indicated by the 'BUG_ON' assertion failure.

Impact

Exploitation of this vulnerability leads to a kernel crash, causing a denial of service by interrupting normal system operations and potentially requiring a manual reboot to restore functionality.