Linux Kernel Off-By-One Vulnerability in MT7925 Wi-Fi Driver

An off-by-one vulnerability has been identified in the MT7925 Wi-Fi driver of the Linux kernel. This issue arises in the 'mt7925_mcu_hw_scan' function, where the 'ssid->ssids[]' and 'sreq->ssids[]' arrays are accessed. The arrays have a maximum capacity defined by 'MT7925_RNR_SCAN_MAX_BSSIDS', and the comparison needs to be adjusted to prevent out-of-bounds access. The vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability could lead to out-of-bounds memory access, potentially causing undefined behavior or memory corruption.